Stack Pointer, “top” of the current stack frame (lower memory)
Base Pointer, “bottom” of the current stack frame (higher memory)
Instruction Pointer, pointer to the next instruction to be executed by the CPU
Source Index, it is used as source index for string operations
Destination Index, it is used as destination index for string operations
Flags Registers (EFLAGS)
Zero Flag, set when result of an operation equals zero
Carry Flag, set when the result of an operation is too large/small
Sign Flag, set when the result of an operation is negative
Stack is a LIFO-Storage (Last In First Out)
mov ebx, eax
Move the value in EAX to EBX
mov eax, 0xDEADBEEF
Move 0xDEADBEEF into EAX
mov edx, DWORD PTR [0x41424344]
Move the 4-byte value at address 0x41424344 into EDX
mov ecx, DWORD PTR [edx]
Move the 4-byte value at the address in EDX, into ECX
mov eax, DWORD PTR [ecx+esi*8]
Move the value at the address ECX+ESI*8 into EAX
mov bx, 0C3EEh
Sign bit of BL is now 1: BH == 1100 0011, BL == 1110 1110
movsx ebx, bx
Load signed 16-bit value into 32-bit register and sign-extend
movzx dx, bl
Load unsigned 8-bit value into 16-bit register and zero-extend
lea edi, [esi+0Bh]
Add 11 to ESI and store the result in EDI
eax is the value stored in eax
[eax] is the value pointed to by eax
1 Byte (8 bits)
2 Bytes (16 bits)
4 Bytes (32 bits)
8 Bytes (64 bits)
MOV is the instruction used for assignment. MOV can move data between a register and memory.
move with Sign Extension. The data is moved from a smaller register into a bigger register, and the sign is preserved.
move with Zero Extension. The data is moved from a smaller register into a bigger register, and the sign is ignored.
Similar to MOV, except that math can be done on the original value before it is used. The [ and ] characters always surround the second parameter, but in this case they do not indicate dereferencing.
Decrements the stack pointer by the size of the operand, then saves the operand to the new address. Equivalent to
sub esp, 4 | mov DWORD PTR [esp], ebx
Sets the operand to the value on the stack, then increments the stack pointer by the size of the operand. Equivalent to
mov ebx, DWORD PTR [esp] | add esp, 4
Compares two operands and sets or unsets flags in the flags register based on the result.
rep, repnz, repz
Repeat while Equal/Non Zero/Zero.