> For the complete documentation index, see [llms.txt](https://nuclei-av.gitbook.io/malware-handbook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nuclei-av.gitbook.io/malware-handbook/assembly-language-basics.md).

# Assembly Language Basics

**Overview**

* **Assembly Language**: Low-level language close to machine code.
* **Focus**: Understanding how assembly language works, specifically x86 assembly, rather than mastering a specific type.

**Memory Architecture**

* **Little-Endian**: Values are written with the least significant byte first.
  * **Example**: 32-bit double word `0x1BA583D4` is written in memory as `D4, 83, A5, 1B`.

**Instruction Format**

* **Operands**: x86 instructions can have 0-3 operands. Typically follows the format `mnemonic destination, source`.
  * **Mnemonic**: Reserved name used for operations (e.g., `MOV` for copying values).
  * **Opcode**: The actual operation code interpreted by hardware.
  * **Example**: `MOV EAX, 0xCODE5AFE` - `MOV` is the mnemonic, `EAX` is the destination, and `0xCODE5AFE` is the source operand.

**Registers**

* **Data Registers**: Used for arithmetic, logical, and other operations.
  * **32-bit Registers**: `EAX`, `EBX`, `ECX`, `EDX`
    * **16-bit Versions**: `AX`, `BX`, `CX`, `DX`
      * **8-bit Versions**: `AH`, `AL`, `BH`, `BL`, `CH`, `CL`, `DH`, `DL`
  * **Primary Accumulator**: `EAX` (used in I/O and arithmetic operations).
  * **Base Register**: `EBX`
  * **Count Register**: `ECX` (used for loop counts).
  * **Data Register**: `EDX` (also used for I/O operations).
* **Pointer Registers**:
  * **32-bit**: `EIP`, `ESP`, `EBP`
    * **16-bit**: `IP`, `SP`, `BP`
  * **EIP**: Instruction pointer (offset address of the next instruction).
  * **ESP**: Stack pointer (points to the top of the stack).
  * **EBP**: Base pointer (references parameter variables in the stack).
* **Index Registers**:
  * **ESI**: Source index (used for string operations).
  * **EDI**: Destination index (used for string operations).
* **Control Registers (Flags)**:
  * **ZF (Zero Flag)**: Set to `1` if the result of an operation is zero; `0` otherwise.

**Segments**

* **Code Segment (CS)**: Contains executable code.
* **Data Segment (DS)**: Contains data.
* **Stack Segment (SS)**: Contains stack data.
* **Extra Segments (ES, FS, GS)**: For additional data storage.

**64-bit vs. 32-bit Registers**

* **64-bit Registers**: Use `R` prefix (e.g., `RAX`, `RBX`, `RCX`, `RDX`).
  * **New Registers**: `R8` to `R15`.
  * **Stack Size**: Larger.
  * **Flags**: `RFLAGS` register.

**Stack**

* **Purpose**: Used for temporary data storage, passing arguments to functions, and saving register values.
* **Instructions**:
  * **`PUSH`**: Stores a value on the stack.
  * **`POP`**: Removes a value from the stack.