program apimonitor;

{$APPTYPE CONSOLE}

uses
  windows;

procedure rtlmovememory (distination,source : pointer; size: dword); stdcall; external 'ntdll.dll' name 'RtlMoveMemory';
function isunderdebug ():bool; stdcall; external 'kernel32.dll' name 'IsDebuggerPresent';

const
bp : byte = $cc;
findapibuffer : array [0..24] of byte = ($8B,$FF,$55,$8B,$EC,$33,$C0,$50,$FF,$75,$0C,$FF,$75,$08,$50,$50,$E8,$8A,$FF,$FF,$FF,$5D,$C2,$08,$00);
var
readeen : byte;
findapiaddr : pointer;

begin
writeln ('//// BYPASS PROCESSE-EXPLORER (SIMPLE) + BYPASS API-MONITOR');
findapiaddr := getprocaddress (loadlibrary ('user32.dll'),'FindWindowW');
copymemory (addr (readeen),findapiaddr,sizeof (readeen));
if (readeen = bp) or (isunderdebug) then
   begin
   writeln ('! API-MONITOR DETECTED , UNHOOKING START ...');
   // unhook code here
   // rtlmovememory (findapiaddr,addr (findapibuffer),sizeof (findapibuffer)) ;
   end else
   begin
   if findwindoww ('PROCEXPL',nil) <> 0 then
   writeln ('+ PROCESSE-EXPLORER DETECTED')
   else
   writeln ('! ERROR PROCESSE-EXPLORER NO DETECTECD');
   end;
while true do sleep ( 1000);
end.