I have a game on my PC that reads and writes registry keys and values to the HKLM hive. I am trying to see if it is possible to modify the game so that it uses the HKCU hive instead.
The source code for this game isn't available so I am trying to disassemble the game binary and see if the assembly can be modified to accomplish this.
I am seeing sections like this in PE Explorer but I can't figure out what parts of it are used to target the HKLM hive:
L004036E0: lea eax,[esp+1Ch] lea ecx,[esp+08h] push eax push 00020019h push ebx call SUB_L00401F70 push eax push 80000002h call [ADVAPI32.dll!RegOpenKeyExA] cmp eax,ebx jnz L004037E9 lea ecx,[esp+14h] lea edx,[esp+000000A0h] push ecx mov ecx,[esp+20h] lea eax,[esp+1Ch] push edx push eax push ebx push SSZ00413090_InstallPath push ecx mov dword ptr [esp+2Ch],00000104h call [ADVAPI32.dll!RegQueryValueExA] cmp eax,ebx jnz L004037E9 cmp dword ptr [esp+18h],00000001h jnz L004037E9 lea edx,[esp+000000A0h] push 0000005Ch push edx lea esi,[esp+000000A8h] call SUB_L00406310 add esp,00000008h cmp eax,ebx jz L00403775 L00403763: