I'm trying to better emulate the actual client by calling Storm's registry function to read the keys that should be inserted into SID_CLIENTID2.  When I call it while in Debug mode, I get an error stating that the value of ESP was not properly saved during a function call, most likely a result of using an incorrect calling convention, however it still returns the correct data.  I then try to run it in Release mode and only receive garbage data.

C/C++:

[code]#include "stdafx.h"
#include <windows.h>
#include <iostream.h>

typedef DWORD (*pSGetRegInf)(LPSTR, LPSTR, BYTE, LPDWORD);

int main(int argc, char* argv[])
{
    DWORD dwRegVer;      // Registration Version
    DWORD dwRegAuth;      // Registration Authority
    DWORD dwClientID;    // Client ID
    DWORD dwClientToken;  // Client Token

HINSTANCE hStorm;
    pSGetRegInf SGetRegInf;

hStorm = LoadLibrary("Storm.dll");
    if (hStorm == NULL)
        return 0;

    SGetRegInf = (pSGetRegInf)(GetProcAddress(hStorm, (char*)(0x01A7)));
if (SGetRegInf == NULL)
return 0;

    (SGetRegInf)("Configuration", "Registration Version", 2, &dwRegVer);
(SGetRegInf)("Configuration", "Registration Authority", 2, &dwRegAuth);
(SGetRegInf)("Configuration", "Client ID", 2, &dwClientID);
(SGetRegInf)("Configuration", "Client Token", 2, &dwClientToken);

cout << "Registration Version: " << dwRegVer << endl;
    cout << "Registration Authority: " << dwRegAuth << endl;
    cout << "Client ID: " << dwClientID << endl;
cout << "Client Token: " << dwClientToken << endl;

    FreeLibrary(hStorm);

return 0;
}
[/code]

Assembly:

[code].text:19016BD4                lea    eax, [esp+284h+var_234]
.text:19016BD8                push    eax
.text:19016BD9                push    2
.text:19016BDB                push    offset aClientToken ; "Client Token"
.text:19016BE0                push    offset aConfiguration ; "Configuration"
.text:19016BE5                call    Storm_423[/code]

Edit:
Nevermind, was a rather stupid _stdcall error.

[code]typedef DWORD (_stdcall *pSGetRegInf) (LPSTR, LPSTR, BYTE, LPDWORD);[/code]

Most of Storm's exports (if not, all) are stdcall

[quote author=UserLoser link=topic=10865.msg103015#msg103015 date=1110371803]
Most of Storm's exports (if not, all) are stdcall
[/quote]

Most.