#include <stdio.h>
#include <Windows.h>
#include <winternl.h>
#include <locale.h>

typedef struct _RTL_PROCESS_MODULE_INFORMATION
{
  HANDLE Section;
  PVOID MappedBase;
  PVOID ImageBase;
  ULONG ImageSize;
  ULONG Flags;
  USHORT LoadOrderIndex;
  USHORT InitOrderIndex;
  USHORT LoadCount;
  USHORT OffsetToFileName;
  UCHAR FullPathName[256];
}RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;
typedef struct _RTL_PROCESS_MODULES
{
  ULONG ModulSayisi;
  RTL_PROCESS_MODULE_INFORMATION Moduller[1];
}RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;

int main()
{
  NTSTATUS ntstatus;
  PRTL_PROCESS_MODULES modules;
  modules = (PRTL_PROCESS_MODULES)VirtualAlloc(NULL, 1024 * 1024, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
  if (!modules){
    return -1;
  }
  decltype(NtQuerySystemInformation)* NtQuerySystemInformationPtr;
  NtQuerySystemInformationPtr = reinterpret_cast<decltype(NtQuerySystemInformation)*>(GetProcAddress(GetModuleHandleW(L"ntdll.dll"),"NtQuerySystemInformation"));
  if (!NT_SUCCESS(ntstatus = NtQuerySystemInformationPtr((SYSTEM_INFORMATION_CLASS)11, modules, 1024 * 1024, NULL))){
    VirtualFree(modules, 0, MEM_RELEASE);
    return -1;
  }
  for (ULONG i = 0; i < modules->ModulSayisi; i++){
    const char* module_name = (const char*)(modules->Moduller[i].FullPathName + modules->Moduller[i].OffsetToFileName);
    if (!lstrcmpiA(module_name, "vmmouse.sys")|| !lstrcmpiA(module_name, "vmrawdsk.sys")|| !lstrcmpiA(module_name, "vmusbmouse.sys")){
      printf("vmware!!!!!\n");
    }
  }
  VirtualFree(modules, 0, MEM_RELEASE);
  return 0;
}