x86 Assembly Cheat Sheet
Key x86/x86-64 registers, NASM instruction syntax, control flow, and the stack/calling convention for low-level programming.
2 PagesAdvancedApr 2, 2026
General-Purpose Registers
The core x86-64 registers and their conventional uses.
- EAX / RAX- 32-bit/64-bit accumulator, commonly holds return values
- EBX / RBX- General-purpose base register
- ECX / RCX- Counter register, used implicitly by loop instructions
- EDX / RDX- Data register, paired with EAX for mul/div
- ESP / RSP- Stack pointer, points to the top of the stack
- EBP / RBP- Base pointer, frame reference for local variables
- EIP / RIP- Instruction pointer, address of the next instruction
Basic Instructions
Data movement and arithmetic (NASM syntax).
asm
section .data msg db "Hello, World!", 0xA ; string with newlinesection .text global _start_start: mov eax, 5 ; move immediate value into eax add eax, 3 ; eax = eax + 3 sub eax, 1 ; eax = eax - 1 mov ebx, eax ; copy eax into ebx inc ebx ; ebx += 1 dec eax ; eax -= 1 cmp eax, ebx ; compare eax and ebx (sets flags)
Control Flow
Jumps and conditional branching.
asm
mov ecx, 5loop_start: cmp ecx, 0 je loop_end ; jump if equal (zero flag set) dec ecx jmp loop_startloop_end: cmp eax, ebx jg greater ; jump if eax > ebx jl less ; jump if eax < ebx jmp done
Stack & Calling Convention
Passing arguments and calling functions.
- push eax- Decrements ESP/RSP, stores eax on the stack
- pop eax- Loads the top of stack into eax, increments ESP/RSP
- call func- Pushes the return address, jumps to func
- ret- Pops the return address, jumps back to the caller
- cdecl- Caller cleans the stack; arguments pushed right-to-left
- System V AMD64 ABI- First 6 integer args passed in RDI, RSI, RDX, RCX, R8, R9
Linux Exit Syscall
Exiting a program on Linux x86-64.
asm
mov rax, 60 ; syscall number for exit xor rdi, rdi ; exit code 0 syscall
Memory Addressing Modes
Ways to reference memory operands in Intel syntax.
asm
mov rax, [rbx] ; direct: value at address in rbxmov rax, [rbx + 8] ; base + displacementmov rax, [rbx + rcx] ; base + indexmov rax, [rbx + rcx*4] ; base + index*scalemov rax, [rbx + rcx*4 + 16] ; full formlea rax, [rbx + rcx*8] ; compute address, no load
Arithmetic & Multiplication
Signed/unsigned multiply and divide with implicit registers.
asm
mov rax, 20mov rbx, 3xor rdx, rdx ; clear high half before divdiv rbx ; unsigned: rax = quotient, rdx = remaindermov rax, -20cqo ; sign-extend rax into rdx:raxidiv rbx ; signed divisionimul rax, rbx, 5 ; rax = rbx * 5 (three-operand form)
RFLAGS Bits
Status flags set by arithmetic and compare instructions.
- CF (carry)- set on unsigned overflow/borrow out of the MSB
- ZF (zero)- set when the result equals zero
- SF (sign)- copy of the result's most-significant bit
- OF (overflow)- set on signed overflow
- PF (parity)- set when low byte has an even number of 1 bits
- DF (direction)- controls string op direction; cld=up, std=down
SSE/AVX Vector Ops
Packed floating-point operations on XMM/YMM registers.
asm
movaps xmm0, [vec_a] ; load 4 aligned floatsmovaps xmm1, [vec_b]addps xmm0, xmm1 ; packed single add (4 lanes)mulps xmm0, xmm1 ; packed multiplymovaps [result], xmm0vaddps ymm0, ymm1, ymm2 ; AVX: 8 floats, non-destructive
String & REP Instructions
Block memory operations using rep prefixes.
asm
; memcpy: copy rcx bytes from rsi to rdicld ; forward directionmov rcx, lenrep movsb; memset: fill rcx bytes with almov al, 0mov rcx, lenrep stosb; scan for a byte in alrepne scasb ; stop when [rdi] == al or rcx == 0
Pro Tip
Remember that cmp and test only set CPU flags — always follow them with the matching conditional jump (je, jne, jg, jl…) to actually branch.
Was this cheat sheet helpful?
Explore Topics
#X86Assembly#X86AssemblyCheatSheet#Programming#Advanced#GeneralPurposeRegisters#BasicInstructions#ControlFlow#StackCallingConvention#DataStructures#CheatSheet#SkillVeris
