I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern.

How do I actually disassemble RegSetValueExW_0?



  • Hi and welcome to RE.SE. I think you have a few misconceptions there. Please read up here and here ...
    – 0xC0000022L
    Apr 19 '21 at 12:12
  • Try looking in api-ms-win-core-registry-l1-1-0.dll (or the specific version that your advapi32.dll is importing from).
    – josh poley
    Apr 19 '21 at 14:52
  • @joshpoley why would you want to do that? After all these API set DLLs only contain "empty" stubs ... the real code for said function - as for most of the "meat" of the old Win32 API - moved to kernelbase.dll ... see the links I posted before.
    – 0xC0000022L
    Apr 19 '21 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.