Hook Request: CommandLineToArgvW

[kevross33]

Checking command line arguments. Some ransomware families for example require arguments to execute (such as keys or just simple options) and in 2022 a few APT28/APT44 droppers used them for certain values to then execute the wiper.

i.e. (8f096e3b5ecd2aca35794a85f8b76093b3968a8737e87e8008710b4014c779e3). (I was going to do a sig based on this but would be more useful if could see if arguments had been passed or not (i.e. indicative if it exits after this that correct arguments need to be determined and used).
ModuleName: SHELL32.dll
ModuleHandle: 0x76260000
FunctionName: CommandLineToArgvW
Ordinal: 0
FunctionAddress: 0x763ba220

https://learn.microsoft.com/en-us/windows/win32/api/shellapi/nf-shellapi-commandlinetoargvw

[KillerInstinct]

Dunno about win7, but on Win10 21h2 this api is truly exported in shcore.dll; shell32.dll is just a stub.