Learning Malware Analysis

2.1 General-Purpose Registers

The x86 CPU has eight general purpose registers: eax, ebx, ecx, edx, esp, ebp, esi, and edi. These registers are 32 bits (4 bytes) in size. A program can access registers as 32-bit (4 bytes), 16-bit (2 bytes), or 8-bit (1 byte) values. The lower 16 bits (2 bytes) of each of these registers can be accessed as ax, bx, cx, dx, sp, bp, si, and di. The lower 8 bits (1 byte) of eax, ebx, ecx, and edx can be referenced as al, bl, cl, and dl. The higher set of 8 bits can be accessed as ah, bh, ch, and dh. In the following diagram, the eax register contains the 4-byte value 0xC6A93174. A program can access the lower 2 bytes (0x3174) by accessing the ax register, and it can access the lower byte (0x74) by accessing the ...