Book Image

Windows Malware Analysis Essentials

By : Victor Marak
Book Image

Windows Malware Analysis Essentials

By: Victor Marak

Overview of this book

Table of Contents (13 chapters)

Registers


The microprocessor has a set of internal memory scratchpads called registers. These are divided into categories and sub-functions. For 32-bit designs, the general-purpose registers, or rather multipurpose registers, (E is for extended) are EAX, EBX, ECX, EDX, EBP, ESI, EDI, and ESP. Their 16-bit counterparts are AX, BX, CX, DX, BP, SI, DI, and SP

Four of them have the following 8-bit subdivisions, where H means High and L means Low:

  • AX = AH,AL

  • BX = BH,BL

  • CX = CH,CL

  • DX = DH,DL

For 64-bit programming, the general-purpose registers are RAX, RBX, RCX, RDX, RBP, RSI, RDI, and RSP:

  • RAX (addressable as EAX/AX/AH/AL) plays the standard role of an accumulator. It is also used as the placeholder for the return value of a function call. All registers of this set are addressable in a 32/16/8-bit size as well.

  • RBX plays the standard role of base indexing during memory access.

  • RCX is normally used as a counter.

  • RDX is normally used for data operations during division and data type extensions using EAX...