> For the complete documentation index, see [llms.txt](https://cyber-reaper.gitbook.io/my-malware-analysis-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cyber-reaper.gitbook.io/my-malware-analysis-guide/guide/advanced-static-analysis/assembly-language.md).

# Assembly Language

## What is Assembly?

Most of the programming languages are mostly human readable, even of some of them like `C` or `C++` looks cryptic and confusing sometimes, but they are considered high level languages.

These high-level languages abstract the processes that happens down there under the hood in the **Central Processing Unit (CPU)** but they need Compilers or Interpreters so they can get translated to a language that the machine understands which is a bunch of zeros and ones. 

Even that was said, back in the day there was a language called `Assembly` , instead of coding directly in zeros and ones, we simply use a set of **CPU** instructions like `jmp`, `mov`, `xor` that translates directly to that binary language, so `Assembly` is the human readable **CPU** instructions set.

For a binary to execute in the `x86` architecture, we 3 things to think about tin the first place:

1. CPU Instructions
2. Memory Registers
3. Stack

Check [Assembly Language](https://en.wikipedia.org/wiki/Assembly_language) for more information.

***

## CPU Instructions

There are 3 main types of CPU Instructions:

1. Arithmetic Instructions, like `sub` 
2. Data Movement Instructions, like `mov` 
3. Control Flow Instructions, like `jmp` 

The table below also shows Instructions and their functionality

<table><thead><tr><th width="216.66668701171875">Instruction</th><th>Description</th></tr></thead><tbody><tr><td>MOV</td><td><strong>Move</strong> <code>eax</code> into <code>edx</code>.</td></tr><tr><td>SUB</td><td>Subtract 2 values or memory addresses.</td></tr><tr><td>JMP</td><td>If you want the program to <strong>Jump</strong> into another location, it has several forms like, JNZ or Jump if not zero, etc.</td></tr><tr><td>PUSH</td><td>Push a value into the Stack.</td></tr><tr><td>POP</td><td>Pop (get and remove) a value from the Stack.</td></tr><tr><td>CALL</td><td>Call a function or API.</td></tr><tr><td>RET</td><td>Return the value of the function Call to wherever it was called from and Returns to the location it was Called from.</td></tr></tbody></table>

***

## Memory Registers

Memory Registers is a type of computer memory that can store a small amount of data withing the **CPU,** these have several functions, this list below shows the most common registers:

1. Extended Accumulator Register(EAX)
2. Extended Base Register (EBX)
3. Extended Data Register (EDX)
4. Extended Base Pointer (EBP)&#x20;
5. Extended Stack Pointer (ESP)
6. Extended Instruction Pointer (EIP)

Check [What is Register Memory?](https://www.geeksforgeeks.org/computer-science-fundamentals/what-is-register-memory/) for more information.

***

## Stack&#x20;

Stack is a special place in memory where you can hold the information while you need to access it quickly. The stack is a data structure that we interact with in **LIFO** order (**L**ast **in** **F**irst **O**ut).

The stack is assigned a certain location in memory (The highest location), and it grows downward, this mean that if the address of the stack is `0xffffffff` then the coming data will have smaller addresses.

Check [Memory Stack Organization in Computer Architecture](https://www.geeksforgeeks.org/computer-organization-architecture/memory-stack-organization-in-computer-architecture/) for more information.