双进程保护（三种方式）

http://www.wolfexp.net/
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.386
.model flat, stdcall
option casemap:none
include windows.inc
include kernel32.inc
include user32.inc

includelib kernel32.lib
includelib user32.lib

.data
szFileName db '111111111.exe',0

.data?
Pid dd ?
hSnapShot dd ?
stProcess PROCESSENTRY32    <?>
stStartUp STARTUPINFO   <?>
stProcInfo PROCESS_INFORMATION <?>
hInstance dd   ?
hWinList dd ?
.code
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_Snapshot proc
invoke   RtlZeroMemory,addr stProcess,sizeof stProcess
mov   stProcess.dwSize,sizeof stProcess
invoke   CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,addr stProcess
mov   hSnapShot,eax
invoke   Process32First,hSnapShot,addr stProcess
    .while   eax
        invoke   lstrcmp,addr szFileName,addr stProcess.szExeFile
        .if eax == NULL
        call _Snapshot1
      .endif
        invoke   Process32Next,hSnapShot,addr stProcess
    .endw
call _Process
   invoke ExitProcess,NULL
_Snapshot endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_Snapshot1 proc
invoke   RtlZeroMemory,addr stProcess,sizeof stProcess
mov   stProcess.dwSize,sizeof stProcess
invoke   CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,addr stProcess
mov   hSnapShot,eax
invoke   Process32First,hSnapShot,addr stProcess
    .while   eax
        invoke   lstrcmp,addr szFileName,addr stProcess.szExeFile
        .if eax == NULL
        call _Snapshot
      .endif
        invoke   Process32Next,hSnapShot,addr stProcess
    .endw
call _Process
   invoke ExitProcess,NULL
_Snapshot1 endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_Process proc
   invoke GetStartupInfo,addr stStartUp
   invoke CreateProcess,addr szFileName,NULL,NULL,NULL,NULL,\
    NORMAL_PRIORITY_CLASS,NULL,NULL,addr stStartUp,addr stProcInfo
ret
_Process endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
start:
    call _Snapshot
end start