Doesn't necessarily mean much but lua/e_protect/client/cl_utils.lua is obfuscated If lua/e_protect/client/cl_utils_clean.lua is genuine then all it does is let you grab client's screens and also checks for exploit GUIs
Do note that screengrabbing sends an HTTPS POST request to stromic .dev/eprotect/img.php, which could be monitored by the developer to catch unlicensed servers (unsure if there was any DRM included in the script beforehand, but if not then they likely do not check this)
/eprotect/lua/e_protect/modules/sv_detectionlogger.lua and /eprotect/lua/e_protect/modules/sv_exploitpatcher.lua contain an identical RunString to one I found in an aHud leak