_SECL_STARTUPINFOW SECL_STARTUPINFOW SECL_STARTUPINFO

https://twitter.com/Tal_Liberman
http://breakingmalware.com

typedef struct _SECL_STARTUPINFOW {
    DWORD   cb;
    LPWSTR  lpReserved;
    LPWSTR  lpDesktop;
    LPWSTR  lpTitle;
    DWORD   dwX;
    DWORD   dwY;
    DWORD   dwXSize;
    DWORD   dwYSize;
    DWORD   dwXCountChars;
    DWORD   dwYCountChars;
    DWORD   dwFillAttribute;
    DWORD   dwFlags;
    WORD    wShowWindow;
    WORD    cbReserved2;
    LPBYTE  lpReserved2;
    HANDLE  hStdInput;
    HANDLE  hStdOutput;
    HANDLE  hStdError;
} SECL_STARTUPINFOW, *LPSECL_STARTUPINFOW;

advapi32!StartInfo_To_SECL_STARTUPINFOW
unsigned long __stdcall StartInfo_To_SECL_STARTUPINFOW(struct _STARTUPINFOW *, struct _SECL_STARTUPINFOW *) proc near

;
; tSeclStartupInfo = edx
; tStartUpInfo = ecx
;

test    tStartUpInfo, tStartUpInfo
jz      lbl_null_input

lbl_null_input:         ; Size
push    44h
push    0               ; Val
push    tSeclStartupInfo ; Dst
call    _memset
add     esp, 0Ch
jmp     lbl_return

mov     eax, [tStartUpInfo+_STARTUPINFOW.cb]
mov     [tSeclStartupInfo+_SECL_STARTUPINFOW.cb], eax
mov     eax, [tStartUpInfo+_STARTUPINFOW.lpReserved]
mov     [tSeclStartupInfo+_SECL_STARTUPINFOW.lpReserved], eax
mov     eax, [tStartUpInfo+_STARTUPINFOW.lpDesktop]
mov     [tSeclStartupInfo+_SECL_STARTUPINFOW.lpDesktop], eax
mov     eax, [tStartUpInfo+_STARTUPINFOW.lpTitle]
mov     [tSeclStartupInfo+_SECL_STARTUPINFOW.lpTitle], eax
mov     eax, [tStartUpInfo+_STARTUPINFOW.dwX]
mov     [tSeclStartupInfo+_SECL_STARTUPINFOW.dwX], eax
mov     eax, [tStartUpInfo+_STARTUPINFOW.dwY]
mov     [tSeclStartupInfo+_SECL_STARTUPINFOW.dwY], eax
mov     eax, [tStartUpInfo+_STARTUPINFOW.dwXSize]
mov     [tSeclStartupInfo+_SECL_STARTUPINFOW.dwXSize], eax
mov     eax, [tStartUpInfo+_STARTUPINFOW.dwYSize]
mov     [tSeclStartupInfo+_SECL_STARTUPINFOW.dwYSize], eax
mov     eax, [tStartUpInfo+_STARTUPINFOW.dwXCountChars]
mov     [tSeclStartupInfo+_SECL_STARTUPINFOW.dwXCountChars], eax
mov     eax, [tStartUpInfo+_STARTUPINFOW.dwYCountChars]
mov     [tSeclStartupInfo+_SECL_STARTUPINFOW.dwYCountChars], eax
mov     eax, [tStartUpInfo+_STARTUPINFOW.dwFillAttribute]
mov     [tSeclStartupInfo+_SECL_STARTUPINFOW.dwFillAttribute], eax
mov     eax, [tStartUpInfo+_STARTUPINFOW.dwFlags]
mov     [tSeclStartupInfo+_SECL_STARTUPINFOW.dwFlags], eax
mov     ax, [tStartUpInfo+_STARTUPINFOW.wShowWindow]
mov     [tSeclStartupInfo+_SECL_STARTUPINFOW.wShowWindow], ax
mov     ax, [tStartUpInfo+_STARTUPINFOW.cbReserved2]
mov     [tSeclStartupInfo+_SECL_STARTUPINFOW.cbReserved2], ax
mov     eax, [tStartUpInfo+_STARTUPINFOW.lpReserved2]
mov     [tSeclStartupInfo+_SECL_STARTUPINFOW.lpReserved2], eax
mov     eax, [tStartUpInfo+_STARTUPINFOW.hStdInput]
mov     [tSeclStartupInfo+_SECL_STARTUPINFOW.hStdInput], eax
mov     eax, [tStartUpInfo+_STARTUPINFOW.hStdOutput]
mov     [tSeclStartupInfo+_SECL_STARTUPINFOW.hStdOutput], eax
mov     eax, [tStartUpInfo+_STARTUPINFOW.hStdError]
mov     [tSeclStartupInfo+_SECL_STARTUPINFOW.hStdError], eax

lbl_return:
xor     eax, eax
retn