用户模式下通过Zw函数直接写注册表

	HMODULE NtDll = GetModuleHandle(L"ntdll.dll");
	if (NtDll)
	{
		ZwCreateKey = (ZWCREATEKEY)GetProcAddress(NtDll,"ZwCreateKey");
		ZwSetValueKey = (ZWSETVALUEKEY)GetProcAddress(NtDll, "ZwSetValueKey");
		ZwClose = (ZWCLOSE)GetProcAddress(NtDll, "ZwClose");
	}
	HANDLE   KeyHandle = NULL;
	OBJECT_ATTRIBUTES oa = { 0 };
	UNICODE_STRING uniKeyCreateName;
	RtlInitUnicodeString(&uniKeyCreateName, L"\\REGISTRY\\Machine\\SOFTWARE\\360Sfea");
	InitializeObjectAttributes(&oa, &uniKeyCreateName, 0, NULL, NULL);
	ULONG status = ZwCreateKey(&KeyHandle, KEY_ALL_ACCESS, &oa, 0, NULL, 0, NULL);

	UNICODE_STRING ValueName;
	RtlInitUnicodeString(&ValueName,L"jestlow");
	DWORD Buffer=0x66666666;
	TongL_PROCESS data = { 0 };
	data.Token = ReadProcess;
	data.Address = NtDll;
	data.buf = &Buffer;
	data.Size = 4;
	status = ZwSetValueKey(KeyHandle, &ValueName, 0, REG_BINARY, &data, sizeof(TongL_PROCESS));