Question: I'm trying to find ZipCryto Password from this execute, but when I open it in ollydbg and it always return to close programs because IsDebuggerPresent module.

I find the solution on the internet and try to
- Use ollydbg plugins (Hide debugger and IsDebugPresent)
- Try to NOP in IsDebuggerPresent module
- Try to force return 0 in IsDebuggerPresent module

There are not working.

I use signsrch to find where is handled the ZipCrypto password and it say

> 
> 0041c57c 3052 function where is handled the ZipCrypto password [32.le.12&]
> 
> 
> 

and where is IsDebuggerPresent

> 
> 00435cd8 2545 anti-debug: IsDebuggerPresent [..17]
> 
> 
> 

Can I bypass IsDebuggerPresent and find ZipCryto password in this execute?
Execute Link: <https://mega.co.nz/#!PMdAjZab!bTO7VbZ6OjhJ_mgiigJ1BApDAgDeVWK_X-mKl9aMZw8>

Sorry for my bad English.
Thanks you.

Answer: 
suppose your exe file name is a1.exe

do this:

* press `Alt+E` to go `Executable modules` window.
* Select a1.exe
* press `Ctrl+N`
* find `IsDebuggerPresent` in importes and select it.
* right click and click `Follow import in Disassembler`
* press `F2` on this opcode.
* Run Program and wait for break point.
* press some `F8` till returning to your code.
* search for some thing like `je` or `jnz` opcodes and change them.
/GS- on the cl command line will remove this dependency.