format PE GUI 4.0
entry start


include '..\..\include\win32a.inc'
ERROR_SUCCESS   = 0

section '.data' data readable writeable

        message_create  db 'Create registry key: "HKEY_CURRENT_USER\.DEFAULT\Test\STRING"',0
        message_write   db 'In the "HKEY_USERS\Test\STRING" write string: "Hello World!"',0
        message_error   db 'Error working program as registry.',0
        title_info      db 'Question',0
        text_to_write   db 'Hello World!',0
        sub_key         db '.DEFAULT\Test\',0
        sub_text_key    db 'STRING',0
        buffer          rb 260
        hkey            dd ?

        size_buf        dd 260

section '.code' code readable executable

  start:
        invoke  MessageBox,0,message_create,title_info,MB_ICONINFORMATION
      .seh_init:
        push    error
        pushd   dword[fs:0]
        mov     [fs:0], esp

      .create_key:
        invoke  RegCreateKey, HKEY_USERS, sub_key, hkey
        cmp     eax, ERROR_SUCCESS
        jne     error

      .write_key:
        invoke  MessageBox,0,message_write,title_info,MB_ICONINFORMATION
        invoke  lstrlen,text_to_write
        invoke  RegSetValueEx,[hkey],sub_text_key,0,REG_SZ,text_to_write,eax
        cmp     eax,ERROR_SUCCESS
        jne     error

      .read_key:
        lea     eax, [size_buf]
        invoke  RegQueryValueEx,[hkey], sub_text_key, 0, REG_SZ, buffer, eax
        cmp     eax,ERROR_SUCCESS
        je      error
      .close_key:
        invoke  RegCloseKey,[hkey]
        mov     esp,[fs:0]
        popd    dword[fs:0]
        jmp     close
  error:
        invoke  RegCloseKey,[hkey]
  close:
        invoke  MessageBox,0,buffer,title_info,MB_ICONINFORMATION
        invoke  ExitProcess,0

section '.idata' import data readable writeable

macro import lib,[functions]
{ common macro import_#lib \{ import lib,functions \} }
macro api [functions]
{ common macro all_api \{ all_api
                          api functions \} }
macro all_api {}
include '..\..\include\api/kernel32.inc'
include '..\..\include\api/user32.inc'
include '..\..\include\api/gdi32.inc'
include '..\..\include\api/advapi32.inc'
include '..\..\include\api/comctl32.inc'
include '..\..\include\api/comdlg32.inc'
include '..\..\include\api/shell32.inc'
include '..\..\include\api/wsock32.inc'
purge import,api
     library kernel32,'KERNEL32.DLL',\
             user32,'USER32.DLL',\
             gdi32,'GDI32.DLL',\
             advapi32,'ADVAPI32.DLL',\
             comctl32,'COMCTL32.DLL',\
             comdlg32,'COMDLG32.DLL',\
             shell32,'SHELL32.DLL',\
             wsock32,'WSOCK32.DLL'
     import_kernel32
     import_user32
     import_gdi32
     import_advapi32
     import_comctl32
     import_comdlg32
     import_shell32
     import_wsock32
     all_api    

        mov     esp,[fs:0]
        popd    dword[fs:0]
        add esp,4 ; pop eax ; etc...    

LONG WINAPI RegQueryValueEx(
  __in          HKEY hKey,
  __in          LPCTSTR lpValueName,
  LPDWORD lpReserved,
  __out         LPDWORD lpType,
  __out         LPBYTE lpData,
  __in_out      LPDWORD lpcbData
);