typedef struct _SYSTEM_PROCESS_INFORMATION {
   ULONG NextEntryOffset;
   ULONG NumberOfThreads;
   BYTE Reserved1[48];
   PVOID Reserved2[3];
   HANDLE UniqueProcessId;
   PVOID Reserved3;
   ULONG HandleCount;
   BYTE Reserved4[4];
   PVOID Reserved5[11];
   SIZE_T PeakPagefileUsage;
   SIZE_T PrivatePageCount;
   LARGE_INTEGER Reserved6[6];
} SYSTEM_PROCESS_INFORMATION;

function GetProcessParentID: Cardinal;
var
 ProcEntry: TProcessEntry32;
 hSnapshot: THandle;
 CurrID: Cardinal;
 Success: Boolean;
begin
 Result := 0;
 hSnapshot := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
 if (hSnapshot <> INVALID_HANDLE_VALUE) then
   try
     ProcEntry.dwSize := SizeOf(ProcEntry);
     Success := Process32First(hSnapshot, ProcEntry);
     if Success then
     begin
       CurrID := GetCurrentProcessId;
       SetLastError(ERROR_SUCCESS);
       while Success do
         if (ProcEntry.th32ProcessID = CurrID) then
         begin
           Result := ProcEntry.th32ParentProcessID;
           Break;
         end
         else
           Success := Process32Next(hSnapshot, ProcEntry);
     end;
     Win32Check(GetLastError);
   finally
     CloseHandle(hSnapshot);
   end
 else
   Win32Check(GetLastError);
end;

function GetProcessParentName: string;
var
 ProcEntry: TProcessEntry32;
 hSnapshot: THandle;
 Success: Boolean;
 ParentPID: Cardinal;
begin
 Result := '';
 hSnapshot := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
 if (hSnapshot <> INVALID_HANDLE_VALUE) then
   try
     ProcEntry.dwSize := SizeOf(ProcEntry);
     Success := Process32First(hSnapshot, ProcEntry);
     if Success then
     begin
       ParentPID := GetProcessParentID;
       SetLastError(ERROR_SUCCESS);
       while Success do
         if (ProcEntry.th32ProcessID = ParentPID) then
         begin
           Result := ProcEntry.szExeFile;
           Break;
         end
         else
           Success := Process32Next(hSnapshot, ProcEntry);
     end;
     Win32Check(GetLastError);
   finally
     CloseHandle(hSnapshot);
   end
 else
   Win32Check(GetLastError);
end;

function GetStartingAsService(const SrvName: string): Boolean;
var
 Mgr, Svc: Integer;
 SSBuf: PServiceStatus;
 SSBufSz: Cardinal;
 SvcState: Cardinal;
begin
 Result := False;
 // То что мы сервис - еще не значит что мы запущены с правами SYSTEM! Поэтому запрашиваем только право чтения
 Mgr := OpenSCManager(nil, nil, GENERIC_READ);
 if (Mgr <> 0) then
 begin
   // Аналогично. Будем только читать
   Svc := OpenService(Mgr, PChar(SrvName), GENERIC_READ);
   Result := (Svc <> 0);
   if Result then
   begin
     QueryServiceStatusEx2(Svc, SC_STATUS_PROCESS_INFO, nil, 0, SSBufSz);
     GetMem(SSBuf, SSBufSz);
     QueryServiceStatusEx2(Svc, SC_STATUS_PROCESS_INFO, SSBuf, SSBufSz, SSbufSz);
     SvcState := SSBuf.dwCurrentState;
     FreeMem(SSBuf);
     Result :=
       (SvcState = SERVICE_START_PENDING) and
       AnsiSameText(GetProcessParentName, 'services.exe');

     CloseServiceHandle(Svc);
   end;
   CloseServiceHandle(Mgr);
 end;
end;

procedure Win32Check(ErrorCode: Cardinal);
begin
 if (ErrorCode <> ERROR_SUCCESS) then
   raise Win32Exception.Create(SysErrorMessage(ErrorCode));
end;

function ParentProcName: string;
const
 ProcessBasicInformation = 0;
var
 Info: PROCESS_BASIC_INFORMATION;
 dwProcessHandle: dword;
 ProcessName: string;
 Hndl: THandle;
begin
 Result:= 'noname';
 dwProcessHandle:= GetCurrentProcess;
 if NtQueryInformationProcess(dwProcessHandle, ProcessBasicInformation, @Info, SizeOf(Info), nil) = NO_ERROR
   then begin
     Hndl:= OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ, False, Info.uInheritedFromUniqueProcessId);
     if Hndl <> 0 then
       try
         SetLength(ProcessName, MAX_PATH);
         if GetModuleBaseNameA(Hndl, 0, PChar(ProcessName), MAX_PATH) > 0
           then Result:= PChar(ProcessName);
       finally
         CloseHandle(Hndl);
       end;
   end;
end;