Registry Functions

This section describes the functions used to access and manipulate the Windows registry. The registry is a hierarchical database that stores configuration settings and options for the operating system and for applications that opt to use it.

Overview

The registry is organized into keys and values. Keys are like folders, and values are like files that contain data. The Win32 API provides a set of functions to:

Connect to remote registries.
Open and close registry keys.
Create, delete, and enumerate keys.
Set, query, and delete registry values.
Handle different data types for registry values.

Key Registry Functions

Opening and Closing Keys

You must open a registry key before you can access its values or subkeys. The RegOpenKeyEx function is commonly used for this purpose.

RegOpenKeyEx: Opens an existing registry key.

LONG RegOpenKeyEx(
  HKEY hKey,
  LPCSTR lpSubKey,
  DWORD ulOptions,
  REGSAM samDesired,
  PHKEY phkResult
);

RegCloseKey: Closes an open registry key.
```
LONG RegCloseKey(
  HKEY hKey
);
```

Querying Registry Values

To retrieve the data associated with a registry value, use RegQueryValueEx.

RegQueryValueEx: Retrieves the type and data for a specified registry value.

LONG RegQueryValueEx(
  HKEY hKey,
  LPCSTR lpValueName,
  LPDWORD lpReserved,
  LPDWORD lpType,
  LPBYTE lpData,
  LPDWORD lpcbData
);

Setting Registry Values

You can create new values or modify existing ones using RegSetValueEx.

RegSetValueEx: Sets the data and attribute of a specified registry value.

LONG RegSetValueEx(
  HKEY hKey,
  LPCSTR lpValueName,
  DWORD dwReserved,
  DWORD dwType,
  const BYTE *lpData,
  DWORD cbData
);

Enumerating Keys and Values

To list the subkeys or values within a registry key, you can use the enumeration functions.

Function	Description
`RegEnumKeyEx`	Enumerates subkeys of the specified registry key.
`RegEnumValue`	Enumerates the values of the specified registry key.

Registry Hives

The registry is composed of several root keys, also known as hives. Some of the most common ones include:

HKEY_CLASSES_ROOT (HKCR)
HKEY_CURRENT_USER (HKCU)
HKEY_LOCAL_MACHINE (HKLM)
HKEY_USERS (HKU)

These predefined handles can be passed as the hKey parameter to functions like RegOpenKeyEx.

Microsoft Docs