/*  name      Vx Api  type      trojan  cve       —  year      unknown  os        Windows  authors   unknown  source    krisyotam  archived  krisyotam (2026)  notes     — */#include "Win32Helper.h" BOOL IsPeSectionW(_In_ LPCWSTR PathToBinary, _In_ LPCWSTR PeSectionName){	BOOL bFlag = FALSE;	HANDLE hHandle = INVALID_HANDLE_VALUE;	PBYTE Buffer = NULL;	LONGLONG SizeOfTargetBinary = 0L; 	PIMAGE_DOS_HEADER Dos = NULL;	PIMAGE_NT_HEADERS Nt = NULL;	PIMAGE_FILE_HEADER File = NULL;	PIMAGE_OPTIONAL_HEADER Optional = NULL; 	PIMAGE_SECTION_HEADER Section = NULL;	PIMAGE_SECTION_HEADER SectionHeaderArray = NULL; 	CHAR SectionName[32] = { 0 }; 	if (WCharStringToCharString(SectionName, (PWCHAR)PeSectionName, StringLengthW(PeSectionName)) == 0)		goto EXIT_ROUTINE; 	SizeOfTargetBinary = GetFileSizeFromPathW((PWCHAR)PathToBinary, FILE_ATTRIBUTE_NORMAL);	if (SizeOfTargetBinary == INVALID_FILE_SIZE)		goto EXIT_ROUTINE; 	hHandle = CreateFileW(PathToBinary, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);	if (hHandle == INVALID_HANDLE_VALUE)		goto EXIT_ROUTINE; 	Buffer = (PBYTE)HeapAlloc(GetProcessHeapFromTeb(), HEAP_ZERO_MEMORY, SizeOfTargetBinary);	if (Buffer == NULL)		goto EXIT_ROUTINE; 	if (!ReadFile(hHandle, Buffer, (DWORD)SizeOfTargetBinary, NULL, NULL))		goto EXIT_ROUTINE; 	if (!RtlLoadPeHeaders(&Dos, &Nt, &File, &Optional, &Buffer))		goto EXIT_ROUTINE; 	SectionHeaderArray = (PIMAGE_SECTION_HEADER)(ULONGLONG(Nt) + sizeof(IMAGE_NT_HEADERS));	for (DWORD dwX = 0; dwX < File->NumberOfSections; dwX++)	{		if (StringCompareA((PCHAR)SectionHeaderArray[dwX].Name, SectionName) == ERROR_SUCCESS)			bFlag = TRUE;	} EXIT_ROUTINE: 	if (Buffer)		HeapFree(GetProcessHeapFromTeb(), HEAP_ZERO_MEMORY, Buffer); 	if (hHandle)		CloseHandle(hHandle); 	return bFlag;} BOOL IsPeSectionA(_In_ LPCSTR PathToBinary, _In_ LPCSTR PeSectionName){	BOOL bFlag = FALSE;	HANDLE hHandle = INVALID_HANDLE_VALUE;	PBYTE Buffer = NULL;	LONGLONG SizeOfTargetBinary = 0L; 	PIMAGE_DOS_HEADER Dos = NULL;	PIMAGE_NT_HEADERS Nt = NULL;	PIMAGE_FILE_HEADER File = NULL;	PIMAGE_OPTIONAL_HEADER Optional = NULL; 	PIMAGE_SECTION_HEADER Section = NULL;	PIMAGE_SECTION_HEADER SectionHeaderArray = NULL; 	SizeOfTargetBinary = GetFileSizeFromPathW((PWCHAR)PathToBinary, FILE_ATTRIBUTE_NORMAL);	if (SizeOfTargetBinary == INVALID_FILE_SIZE)		goto EXIT_ROUTINE; 	hHandle = CreateFileA(PathToBinary, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);	if (hHandle == INVALID_HANDLE_VALUE)		goto EXIT_ROUTINE; 	Buffer = (PBYTE)HeapAlloc(GetProcessHeapFromTeb(), HEAP_ZERO_MEMORY, SizeOfTargetBinary);	if (Buffer == NULL)		goto EXIT_ROUTINE; 	if (!ReadFile(hHandle, Buffer, (DWORD)SizeOfTargetBinary, NULL, NULL))		goto EXIT_ROUTINE; 	if (!RtlLoadPeHeaders(&Dos, &Nt, &File, &Optional, &Buffer))		goto EXIT_ROUTINE; 	SectionHeaderArray = (PIMAGE_SECTION_HEADER)(ULONGLONG(Nt) + sizeof(IMAGE_NT_HEADERS));	for (DWORD dwX = 0; dwX < File->NumberOfSections; dwX++)	{		if (StringCompareA((PCHAR)SectionHeaderArray[dwX].Name, PeSectionName) == ERROR_SUCCESS)			bFlag = TRUE;	} EXIT_ROUTINE: 	if (Buffer)		HeapFree(GetProcessHeapFromTeb(), HEAP_ZERO_MEMORY, Buffer); 	if (hHandle)		CloseHandle(hHandle); 	return bFlag;}