Detect-It-Easy/db/COM/RCC.2.sg

// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

init("protector", "RCC II");

function detect() {
    if (Binary.compare("fabc....ffe4")) {
        var nOffset = Binary.readWord(2) - 256;
        if (Binary.compare("83c4..bc....60e8$$$$e8$$$$50b8....58eb", nOffset)) {
            sVersion = "0.51/386";
            bDetected = true;
        }
    } else if (Binary.compare("90bd....ffe5")) {
        var nOffset = Binary.readWord(2) - 256;
        if (Binary.compare("faf7dc87ec83c4..81c4....f7dc83ec..87ecbc....50535251061eb9....b0..e6", nOffset)) {
            sVersion = "1.08h";
            bDetected = true;
        }
    } else if (Binary.compare("fcbe....bf....5657b9....f3a55e5f33db33d2")) {
        sVersion = "1.08h";
        bDetected = true;
    }

    return result();
}