BOOL IsVMware9xTrw()
{
    // detect NT/XP/Vista
    if ( (GetVersion() & 0x80000000) == 0 )
    {
        return FALSE;
    }
 
    // detect VMWare (anti debugging trick against TRW)
    // VMware isn't detected with vm acceleration disabled
    __try
    {
        __asm
        {
            sub    esp, 6
            sidt   fword ptr [esp]
            pop    ax
            pop    eax
            mov    al, byte ptr [eax + 00Eh]
        }
    }
    __except(EXCEPTION_EXECUTE_HANDLER)
    {
        return TRUE;
    }
 
    return FALSE;
}