Pasted

VAR remotedebugger
VAR is_debugger_present
VAR create_toolhelp
VAR nt_query_info_process
 
 
GPA "CheckRemoteDebuggerPresent", "kernel32"
MOV remotedebugger, $RESULT
 
 
GPA "IsDebuggerPresent", "kernel32"
MOV is_debugger_present, $RESULT
 
GPA "CreateToolhelp32Snapshot", "kernel32"
MOV create_toolhelp, $RESULT
 
GPA "NtQueryInformationProcess", "ntdll"
MOV nt_query_info_process, $RESULT
 
 
CMP remotedebugger, 0
JE api_not_found
BP remotedebugger
CMT remotedebugger, "CheckRemoteDebuggerPresent"
 
CMP is_debugger_present, 0
JE api_not_found
BP is_debugger_present
CMT is_debugger_present, "IsDebuggerPresent"
 
CMP create_toolhelp, 0
JE api_not_found
BP create_toolhelp
CMT create_toolhelp, "CreateToolhelp32Snapshot"
 
CMP nt_query_info_process, 0 
JE api_not_found
BP nt_query_info_process
CMT nt_query_info_process, "NtQueryInformationProcess"
 
MSG "All APIs have been located and broken on"
 
JMP the_end
api_not_found:
MSG "There was a problem finding one or more APIs, check the breakpoint list"
 
the_end:
RET