# x86/x64 Instruction Quick Reference for Malware Analysis

## Registers

### General Purpose (32-bit / 64-bit)
| 32-bit | 64-bit | Common Use |
|--------|--------|------------|
| EAX | RAX | Return value, accumulator |
| EBX | RBX | Base pointer (callee-saved) |
| ECX | RCX | Counter, 1st arg (x64 Windows) |
| EDX | RDX | Data, 2nd arg (x64 Windows) |
| ESI | RSI | Source index, 1st arg (x64 Linux) |
| EDI | RDI | Destination index, 2nd arg (x64 Linux) |
| ESP | RSP | Stack pointer |
| EBP | RBP | Base/frame pointer |
| - | R8-R15 | Additional (x64 only) |

## Common Instructions

### Data Movement
| Instruction | Description |
|-------------|-------------|
| MOV dst, src | Copy src to dst |
| LEA dst, [addr] | Load effective address |
| PUSH val | Push onto stack |
| POP dst | Pop from stack |
| XCHG a, b | Exchange values |
| MOVZX dst, src | Move with zero-extend |
| MOVSX dst, src | Move with sign-extend |

### Arithmetic
| Instruction | Description |
|-------------|-------------|
| ADD dst, src | dst = dst + src |
| SUB dst, src | dst = dst - src |
| MUL src | EDX:EAX = EAX * src (unsigned) |
| IMUL src | EDX:EAX = EAX * src (signed) |
| DIV src | EAX = EDX:EAX / src |
| INC dst | dst = dst + 1 |
| DEC dst | dst = dst - 1 |
| NEG dst | dst = -dst |

### Bitwise Operations
| Instruction | Description |
|-------------|-------------|
| AND dst, src | Bitwise AND |
| OR dst, src | Bitwise OR |
| XOR dst, src | Bitwise XOR |
| NOT dst | Bitwise NOT |
| SHL dst, n | Shift left |
| SHR dst, n | Shift right (logical) |
| SAR dst, n | Shift right (arithmetic) |
| ROL dst, n | Rotate left |
| ROR dst, n | Rotate right |

### Control Flow
| Instruction | Description |
|-------------|-------------|
| JMP addr | Unconditional jump |
| JE/JZ addr | Jump if equal/zero |
| JNE/JNZ addr | Jump if not equal/not zero |
| JA/JG addr | Jump if above/greater |
| JB/JL addr | Jump if below/less |
| CALL addr | Call function |
| RET | Return from function |
| CMP a, b | Compare (sets flags) |
| TEST a, b | AND test (sets flags) |
| LOOP addr | Decrement ECX, jump if nonzero |

### String Operations
| Instruction | Description |
|-------------|-------------|
| REP MOVSB | Copy ECX bytes from ESI to EDI |
| REP STOSB | Fill ECX bytes at EDI with AL |
| REPNE SCASB | Scan for AL in string at EDI |

## Calling Conventions

### x86 (32-bit)
- **cdecl**: Arguments pushed right-to-left on stack; caller cleans up
- **stdcall** (Win32 API): Arguments on stack; callee cleans up
- **fastcall**: First 2 args in ECX, EDX; rest on stack

### x64 Windows
- First 4 args: RCX, RDX, R8, R9 (integers) or XMM0-XMM3 (floats)
- Additional args on stack
- 32-byte shadow space required

### x64 Linux (System V ABI)
- First 6 args: RDI, RSI, RDX, RCX, R8, R9
- Additional args on stack

## Common Malware Patterns

### Function Prologue/Epilogue
```
push ebp          ; Save old base pointer
mov ebp, esp      ; Set up new frame
sub esp, 0x20     ; Allocate local variables
...
mov esp, ebp      ; Restore stack
pop ebp           ; Restore base pointer
ret               ; Return
```

### API Hashing (resolve by hash)
```
xor edx, edx      ; Clear hash
movzx eax, byte [esi]  ; Load character
ror edx, 13       ; Rotate hash
add edx, eax      ; Add character
inc esi            ; Next character
test al, al       ; Check null terminator
jnz loop           ; Continue if not null
cmp edx, 0xDEADBEEF  ; Compare with target hash
```

### XOR Decryption Loop
```
mov ecx, length    ; Set counter
mov esi, encrypted ; Source pointer
mov al, key        ; XOR key
loop:
  xor [esi], al    ; Decrypt byte
  inc esi           ; Next byte
  dec ecx           ; Decrement counter
  jnz loop          ; Continue
```

### Stack Strings (anti-static-analysis)
```
mov dword [ebp-0x10], 0x6C6C6548  ; "Hell"
mov dword [ebp-0x0C], 0x6F57206F  ; "o Wo"
mov dword [ebp-0x08], 0x00646C72  ; "rld\0"
```