Using Windows Registry Functions in Assembly Language - windows

Question

I am trying to use the Windows registry functions to create a registry key in the 'Software\Microsoft\Windows\CurrentVersion\Run' key in assembly language. My program crashes and displays a Windows error message. Here is the code:
includelib \Masm64\Lib\Kernel32.lib
includelib \Masm64\Lib\Advapi32.lib
extrn ExitProcess : proc
extrn RegCreateKeyExA : proc
dseg segment para 'DATA'
rhdl dd 0
sbky db 'Software\Microsoft\Windows\CurrentVersion\Run\startupprogram.exe', 0
dseg ends
cseg segment para 'CODE'
start proc ;Use link.exe to define entry point
sub rsp, 28h
push 0
push qword ptr [rhdl]
push 0
push 0
push 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [sbky]
mov rcx, 8000001h
call RegCreateKeyExA
xor ecx, ecx ; exit code = 0
call ExitProcess
start endp
cseg ends
end
I would appreciate your help. Perhaps I have disregarded the Windows calling convention?

Answer 1

In the Win64 x64 calling convention you have to reserve stack slots for the four arguments passed in the registers:
From http://msdn.microsoft.com/en-us/library/ms235286.aspx:
The caller is responsible for allocating space for parameters to the callee, and must always allocate sufficient space for the 4 register parameters, even if the callee doesn’t have that many parameters.
So the RegCreateKeyExA() function is treating the last four things you pushed onto the stack as locations reserved for the four register arguments, then is trying to get the other arguments from the first push 0 then whatever random garbage is in the area of the stack you reserved with the sub rsp,28h.
Try:
push 0
push qword ptr [rhdl]
push 0
push 0
push 0
sub rsp, 20h ; reserve slots for arguments passed in regs
xor r9d, r9d
xor r8d, r8d
lea rdx, [sbky]
mov rcx, 8000001h
call RegCreateKeyExA

Answer 2

It's not something I've worked on but I have a non MASM example
SYS "SetWindowPos", #hwnd%, 0, xpos%, ypos%, 0, 0, 5
becomes
push 5
push 0
push 0
push ypos%
push xpos%
push 0
push #hwnd%
call "SetWindowPos"
There's an order of assembly by a compiler where it searches for internal calls within the program then looks for external calls (ie windows ones)
It all boils down to how your compiler operates for these things
Probably easier to experiment with simpler calls to start with
push 16d
call "MessageBeep"
and
push 8d
call "MessageBeep"
for example
Two beeps
push 8
call "MessageBeep"
mov eax,1
.ag
inc eax
cmp eax,&FFFFFFF
jb ag
push 16
call "MessageBeep"
etc