function CheckIfCryptedPE(dwPID:DWORD):Boolean;
var
hProcess, fFile:THandle;
FileName:String;
MemData, FileData:Array[0..$400] of Byte;
ModInfo:TModuleInfo;
dwRead:DWORD;
pIDHF, pIDHM:PImageDosHeader;
pINHF, pINHM:PImageNtHeaders;
begin
Result := False;
hProcess := OpenProcess(PROCESS_VM_READ or PROCESS_VM_OPERATION OR PROCESS_QUERY_INFORMATION, False, dwPID);
if (hProcess = 0) then Exit;
FileName := GetProcessPath(dwPID);
if (FileName = '') then
begin
   Writeln('(FileName = '''')');
   CloseHandle(hProcess);
   Exit;
end;
fFile := CreateFileA(PChar(FileName), GENERIC_READ, FILE_SHARE_READ or FILE_SHARE_WRITE, nil, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
if (fFile = INVALID_HANDLE_VALUE) then
begin
   Writeln('fFile = INVALID_HANDLE_VALUE');
   CloseHandle(hProcess);
   Exit;
end;

ModInfo := GetInfo(dwPID);
if (ModInfo.lpBaseOfDll = nil) then
begin
   Writeln('(ModInfo.lpBaseOfDll = nil)');
   CloseHandle(hProcess);
   CloseHandle(fFile);
   Exit;
end;

ReadProcessMemory(hProcess, ModInfo.lpBaseOfDll, @MemData[0], $400, dwRead);
ReadFile(fFile, FileData[0], $400, dwRead, nil);
CloseHandle(fFile);
CloseHandle(hProcess);

pIDHF := @FileData[0];
pIDHM := @MemData[0];

pINHF := Pointer(Integer(pIDHF) + pIDHF^._lfanew);
pINHM := Pointer(Integer(pIDHM) + pIDHM^._lfanew);

Writeln('SizeOfImage --Memory:' + IntToHex(pINHM^.OptionalHeader.SizeOfImage, 8) + '-- File:' + IntToHex(pINHF^.OptionalHeader.SizeOfImage, 8));
Writeln('SizeOfCode --Memory:' + IntToHex(pINHM^.OptionalHeader.SizeOfCode, 8) + '-- File:' + IntToHex(pINHF^.OptionalHeader.SizeOfCode, 8));
Writeln('AddressOfEntryPoint --Memory:' + IntToHex(pINHM^.OptionalHeader.AddressOfEntryPoint, 8) + '-- File:' + IntToHex(pINHF^.OptionalHeader.AddressOfEntryPoint, 8));
Writeln('BaseOfCode --Memory:' + IntToHex(pINHM^.OptionalHeader.BaseOfCode, 8) + '-- File:' + IntToHex(pINHF^.OptionalHeader.BaseOfCode, 8));
Writeln('CheckSum --Memory:' + IntToHex(pINHM^.OptionalHeader.CheckSum, 8) + '-- File:' + IntToHex(pINHF^.OptionalHeader.CheckSum, 8));
Writeln('SizeOfHeaders --Memory:' + IntToHex(pINHM^.OptionalHeader.SizeOfHeaders, 8) + '-- File:' + IntToHex(pINHF^.OptionalHeader.SizeOfHeaders, 8));
Writeln('SizeOfHeaders --Memory:' + IntToHex(pINHM^.FileHeader.TimeDateStamp, 8) + '-- File:' + IntToHex(pINHF^.FileHeader.TimeDateStamp, 8));

if (pINHM^.OptionalHeader.CheckSum > 0) then
begin
   if pINHM^.OptionalHeader.CheckSum = pINHF^.OptionalHeader.CheckSum then Exit;
end
   else
    begin
     if ( pINHM^.FileHeader.TimeDateStamp = pINHF^.FileHeader.TimeDateStamp) then Exit;
    end;

Result := True;
end;