EAX, EDX, ECX, EBX, ESI, EDI, EBP, ESP, EIP



EAX - accumulator register

for performing calculations as well as storing return values from function calls
many optimized instructions in x86 instruction set are designed to move data into and out of the EAX register and perform calculations on that data
most basic operations like add, subtract, and compare are optimized to use the EAX register
more specialized operations like multiplication or division can occur _only_ within the EAX register
you can easily determine if a function call has failed or succeeded based on the value stored in EAX
you can determine the actual value of what the function is returning


EBX - base register

extra storage, was not designed for anything in specific


ECX - count register
used for looping operations
the repeated operations could be storing a string or counting numbers
counts downward, not upward, for example in Python:

counter = 0
while counter < 10:
  print "counter: %d", %counter
  counter += 1

translated to assembly ECX would equal 10 on the first loop, 9 on the second, and so on
confusing because this is the opposite of what Python is showing


EDX - data register
basically an extension of the EAX register, assists in storing extra data for more complex calculations like multiplication and divison
can also be used for general purpose storage but it is most commonly used in conjunction with calculations performed with EAX




ESI - source index register

holds the location of the input stream
used for reading


EDI - destination index register

holds the location where the result of a data operation is stored
used for writing


ESI and EDI are used for loops that process data efficiently




EIP - instruction pointer register

points to the current instruction that is being executed
as the CPU moves through the binary code, EIP is updated to reflect the location where the execution is occuring


ESP - stack pointer register

used for managing function calls and stack operations
when a function is called the arguments to the function are pushed on to the stack and are followed by the return address
the ESP points to the very top of the stack and so it will point to the return address


EBP - base pointer register

used for managing function calls and stack operations
used to point to the bottom of the call stack
sometimes a compiler uses optimizations to remove the EBP register as a stack frame pointer
sometimes the EBP register is freed up to be used like any other general purpose register



EFL - extended flags register