Learning Malware Analysis

2.3 EFLAGS Register

The eflags register is a 32-bit register, and each bit in this register is a flag. The bits in EFLAGS registers are used to indicate the status of the computations and to control the CPU operations. The flag register is usually not referred to directly, but during the execution of computational or conditional instructions, each flag is set to either 1 or 0. Apart from these registers, there are additional registers, which are called segment registers (cs, ss, ds, es, fs, and gs), which keep track of sections in the memory.