Detect-It-Easy/db/PE/CodeFusion_Wizard.1.sg

// Detect It Easy: detection rule file
// Author: hypn0 <hypn0@mail.ru>

init("patcher", "CodeFusion Wizard");

function detect() {
    if (PE.compareEP("558bec83c4..535657e8........e8........33c05568........64ff30648920e8........e8........a3........833d")) {
        if (PE.compareOverlay("'@._P-DATA_.@'")) {
            bDetected = true;
        }
    }

    return result();
}