private static ISignature IdentifyPhoenixProtector(AssemblyDefinition asmDef, out bool found) { found = false; if (asmDef.FindMethod(mDef => mDef.Body.Instructions.GetOpCodeCount(OpCodes.Xor) == 2 && mDef.Body.Instructions.FirstOfOpCode(OpCodes.Shl) != null && mDef.Body.Instructions.FirstOfOpCode(OpCodes.Or) != null) != null || (asmDef.EntryPoint.Name.StartsWith("?") && asmDef.EntryPoint.Name.EndsWith("?"))) { found = true; return new Signatures.PhoenixSignature(); } return new Signatures.UnidentifiedSignature(); }