I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern.

How do I actually disassemble RegSetValueExW_0?



  • Hi and welcome to RE.SE. I think you have a few misconceptions there. Please read up here and here ...
    – 0xC0000022L
    Commented Apr 19, 2021 at 12:12
  • Try looking in api-ms-win-core-registry-l1-1-0.dll (or the specific version that your advapi32.dll is importing from).
    – josh poley
    Commented Apr 19, 2021 at 14:52
  • @joshpoley why would you want to do that? After all these API set DLLs only contain "empty" stubs ... the real code for said function - as for most of the "meat" of the old Win32 API - moved to kernelbase.dll ... see the links I posted before.
    – 0xC0000022L
    Commented Apr 19, 2021 at 15:00


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.