BNETDocs
C>S 0x18 SID_REGISTRY
Message Id:0x18
Message Name:SID_REGISTRY
Direction:Client to Server
Used By:(nothing or unknown)
Format:

(UINT32) Cookie
(STRING) Key Value 

Remarks

Returns the requested registry value

Comments
Caaaaarrrrlll

You would think Blizzard would actually have the Key Value be VOID, not STRING. Shame I cannot test that to see if it really is a VOID, because Battle.net does not use this anymore.

Allowing access to the Windows registry without checking what is requested first is always a security risk, even if the data being requested is not changed. Does anyone know what Battle.net used to use this for? What values (paths and keys) it told the client to send the value of?