Cheat Engine

[predprey]

1. How do we know which registers are used to passed which variables to Windows API functions? Other than to analyze the function in disassembly view and try to reverse it, the other way is to glance at Windows' API functions and try to guess the variables passed in order from eax-edx and then the stack right? But I recalled reading somewhere too that sometimes variables are passed directly through the stack instead of registers?

2. I presume if some .dll library is not bundled and loaded with a program, we won't be able to call the functions that are in that library right?

[Dark Byte]

1:
Windows API uses the stdcall calling method

In 32 bit windows that means 0 registers, and just on the stack only.

In 64 bit rcx, rdx, r8 and r9, and stack (https://msdn.microsoft.com/en-us/library/ms235286.aspx)

2:
The function LoadLibrary is available in the kernel, which any running program loads.
Together with getProcAddress you can get a function from that dll

[predprey]

ah......ok. thanks.