[SYSTEM BRIEFING]

ACCESS LEVEL: TIER 02

INTEL TYPE: INSTRUCTION SET ARCHITECTURE (ISA)

TARGET: x86_64 REGISTERS & OPCODES

If C++ is a high-level conversation, Assembly is the CPU’s direct commands. When you reverse a binary, you are reading these exact instructions. In this module, we decode the “Big Three” instructions you will see in 90% of all malware and software.

0x01: The General Purpose Registers

Registers are the CPU’s “internal pockets.” They are much faster than RAM.

• RAX: The “Accumulator.” Usually holds the return value of a function.
• RIP: The “Instruction Pointer.” This is the most important register—it points to the next line of code to be executed.
• RSP: The “Stack Pointer.” (As discussed in p2.0).

0x02: The Fundamental Instructions

1. MOV (Move): Copies data from one place to another.
   • mov rax, 5 (Put the number 5 into the RAX register).
2. ADD / SUB (Arithmetic): Modifies values.
   • add rax, 10 (RAX is now 15).
3. CMP / JNE (Logic & Branching): This is how “If Statements” work in Assembly.
   • cmp rax, 15 (Is RAX 15?)
   • jne p2.2_error (If Jump if Not Equal, go to a different part of the code).

The Mission Checkpoint (Terminal Logic)