win32 api detects:
Code:
MessageBox
GetAsyncKeyState
nt/zw api's in x3.xem
Code:
NtQueryInformationProcess
NtQueryVirtualMemory
NtReadVirtualMemory
NtQueryInformationThread
NtCreateFile
NtReadFile
NtOpenFile
NtQueryInformationFile
NtSetInformationFile
NtWaitForSingleObject
NtTerminateProcess
NtWow64QueryInformationProcess64
NtWow64QueryVirtualMemory64
NtWow64ReadVirtualMemory64
ZwOpenDirectoryObject
ZwQueryDirectoryObject
ZwClose
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
SeDegubPrivileges
Also try removing PE header.
Dunno if this will help, I have no experience in the actual making of a bypass.