.386 .model flat,stdcall option casemap:none
include windows.inc include kernel32.inc includelib kernel32.lib include user32.inc includelib user32.lib include advapi32.inc ;必须包含这个头文件 includelib advapi32.lib
.data? hInstance dd ? hKey dd ? hSubKey dd ? szExeBuffer db MAX_PATH dup (?) szReadBuffer db MAX_PATH dup (?) szcbData dd ? .const szKeyAutorun db 'software/Microsoft/Windows/CurrentVersion/Run',0 szValueAutorun db 'MySoftwareB',0 ;子键 szKeyName db 'ExeName',0 ;子键的键值项
.code start: invoke RegOpenKeyEx,HKEY_LOCAL_MACHINE,addr szKeyAutorun,NULL,KEY_ALL_ACCESS,addr hKey ;打开键 .if eax == ERROR_SUCCESS invoke RegCreateKeyEx,hKey,addr szValueAutorun,NULL,NULL,/ ;创建子键 REG_OPTION_NON_VOLATILE,KEY_ALL_ACCESS,NULL,addr hSubKey,NULL invoke GetModuleFileName,NULL,addr szExeBuffer,MAX_PATH ;获取可执行文件名 invoke lstrlen,addr szExeBuffer ;inc eax ;cbData要与类型对应，REG_SZ型应为字符串长度+1，必须设置 ;REG_SZ型好像不需要再加一，REG_EXPAND_SZ需要加一 invoke RegSetValueEx,hSubKey,addr szKeyName,NULL,REG_SZ,addr szExeBuffer,eax ;创建键值项 mov eax,MAX_PATH mov szcbData,eax ;必须把lpData缓冲区长度放在这个lpcbData缓冲区里 invoke RegQueryValueEx,hSubKey,addr szKeyName,NULL,NULL,addr szReadBuffer,addr szcbData invoke MessageBox,NULL,addr szReadBuffer,NULL,MB_OK invoke RegCloseKey,hKey ;关闭子键句柄 invoke RegCloseKey,hSubKey ;关闭另一个子键句柄，根键句柄不需关闭 .endif invoke ExitProcess,NULL end start
