Understanding a negative offset of a registry data reference to a dll file <p>I almost have an answer to <a href="http://stackoverflow.com/questions/7337343/windows-7-firewall-modify-group-items-from-command-line">my last question</a>, but I need help.</p> <p>The Windows Firewall Rules (Vista and up) are stored in the Registry <code>HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules</code></p> <p>Example rule: <code>v2.0|Action=Allow|Active=TRUE|Dir=Out|Protocol=6|Profile=Domain|RPort=5722|App=%SystemRoot%\system32\dfsr.exe|Svc=Dfsr|Name=@FirewallAPI.dll,-32257|Desc=@FirewallAPI.dll,-32260|EmbedCtxt=@FirewallAPI.dll,-32252|Edge=FALSE|</code></p> <p>The field I need to decode is <code>EmbedCtxt=@FirewallAPI.dll,-32252</code></p> <p>I think it references <code>C:\WINDOWS\System32\FirewallAPI.dll</code>, but I can't figure out how the number works. The file is ~400KB depending.</p> <p>I tried a few variations like pretending it was an unsigned <code>short</code>, pretending it was not negative, pretending it was offset from the end, but they did not look right when I arrived at the location with my hex editor.</p> <p>Could somebody give me their ideas? What this number might mean? I hardly know anything about DLL files. It could even be a section number for all I know.</p> <p>I also tried searching the text for the expected output, but it seems it is neither byte per character, nor is it UTF-16, either that or I am doing something wrong.</p>