Whether PatchGuard is disabled or not can not be detected if malware has done manipulation.
You cannot check by files because you cannot be sure if you are checking the manipulated one or the backup. In most cases, you are checking backup.
You cannot check by dumping memory because the initialization codes are in ".init" section, where memory would be released after execution.
At long last, the jumping hands of time will be halted by a weakling cast in eternal solitude.