mov ax, @.data
mov ds, ax

if (sub_116F0() == 0)
//Incorrect key
else
//Correct Key

.text:00107DB8 LDR R1, =aClsid ; lpSubKey = "CLSID"
.text:00107DBC MOV R6, R0
.text:00107DC0 STR R3, [SP,#0x34+var_34] ;STR R3,[SP]; phkResult
.text:00107DC4 MOV R3, #0 ; samDesired = 0
.text:00107DC8 MOV R2, #0 ; ulOptions = 0
.text:00107DCC MOV R0, #0x80000000 ; hKey = HKEY_CLASS_ROOT
.text:00107DD0 BL RegOpenKeyExW
.text:00107DD4 MOVS R3, R0 ; test operation result
.text:00107DD8 BEQ _OpenFailed

Command Hex
B xxxxxxEA
BEQ xxxxxx0A
BNE xxxxxx1A
BGE xxxxxxAA
BHI xxxxxx8A
BLT xxxxxxBA
BCC xxxxxx3A
BCS xxxxxx2A
BPL xxxxxx5A
BMI xxxxxx4A
BLS xxxxxx9A
BGT xxxxxxCA
BLE xxxxxxDA

LDR r0, [r1] ; r0 := mem [r1]
STR r0, [r1] ; mem [r1] := r0
LDR r0,[r1, #4] ; r0 := mem[r1+4]

LDRB r0, [r1] ; r0 := mem [r1] [7:0]
STRB r0, [r1] ; mem [r1] [7:0] := r0

LDR r0, [r1], #4 ; r0 := mem[r1]
; r1 := r1 + 4

LDMIA r1,{r0, r2, r5} ; r0 := mem [r1]
; r2 := mem [r1+4]
; r5 := mem [r1+8]

STMFD SP!, {R4-R6,LR} ; Lưu giá trị R4, R5 & LR
; vào stack, trừ SP đi 4 x 4 = 0x10
SUB SP, SP, #0x24 ; Dành 0x24 bytes cho local vars
....
ADD SP, SP, #0x24 ; Phục hồi trạng thái stack
LDMFD SP!, {R4-R6,PC} ; Phục hồi thanh ghi R4, R6, trả về địa chỉ sau khi gọi BL vào thanh ghi PC (R15)

SWP Rd, Rm, [Rn]

B LABEL

MOV r0, #0 ; initialize counter
LOOP: ...
ADD r0, r0, #1 ; increment counter
CMP r0, #10 ; compare with limit
BNE LOOP ; repeat if not equal
... ; else continue

Branch Interpretation Normal Uses
--------------------------------------------------------------
B Unconditional Always take this branch
BAL Always Always take this branch
BEQ Equal Comparison equal or zero result
BNE Not equal Comparison not equal or zero result
BPL Plus Result positive or zero
BMI Minus Result minus or negative
BCC Carry clear Arithmetic operation did not give carry-out
BLO Lower Unsigned comparison gave lower
BCS Carry set Arithmetic operation gave carry-out
BHS Higher or same Unsigned comparison gave higher or same
BVC Overflow clear Signed integer operation ; no overflow occurred
BVS Overflow set Signed integer operation ; overflow occurred
BGT Greater than Signed integer comparison gave greater than
BGE Greater or equal Signed integer comparison gave greater or equal
BLT Less than Signed integer comparison gave less than
BLE Less or equal Signed integer comparison gave less than or equal
BHI Higher Unsigned comparison gave highe
BLS Lower or same Unsigned comparison gave lower or same

CMP r0, #5 ; if (r0 != 5) {
ADDNE r1, r1, r0 ; r1 := r1 + r0 - r2
SUBNE r1, r1, r2 ; }

Opcode Mnemonic Interpretation Status flag state
[31:28] extension for execution
----------------------------------------------------------------------------------
0000 EQ Equal / equals zero Zset
0001 NE Not equal Zclear
0010 CS/HS Carry set / unsigned higher or same Cset
0011 CC/LO Carry clear / unsigned lower Cclear
0100 MI Minus / negative Nset
0101 Pl Plus / positive or zero Nclear
0110 VS Overflow Vset
0111 VC No overflow Vclear
1000 HI Unsigned higher Cset and Zclear
1001 LS Unsigned lower or same Cclear or Zset
1010 GE Signed greater than or equal N equals V
1011 LT Signed less than N is not Equal to V
1100 GT Signed greater than Z clear and N equals V
1101 LE Signed less than or equal Z set or Nis not equal to
1110 AL Always any
1111 NV Never (do not use!) none

BL SUBR ; branch to SUBR
... ; return to here
SUBR ... ; subroutine entry point
MOV pc, r14 ; return

BL SUB1 ; branch to SUB1
...
SUB1 STMDA r13!, {r0-r2, r14} ; save regs
BL SUB2
...
LDMIB r13!, {r0-r2, pc} ; restore regs + return
SUB2 ...
MOV pc, r14 ; return

+----------------------------------------+ 0xFFFFFFFF
| | | Kernel Virtual Address: |
| | 2 | KPAGE Trap Area, |
| | G | KDataStruct, etc |
| | B | ... |
| | |--------------------------------+ 0xF0000000
| 4 | K | Static Mapped Virtual Address |
| G | E | ... |
| B | R | ... |
| | N |--------------------------------+ 0xC4000000
| V | E | NK.EXE |
| I | L |--------------------------------+ 0xC2000000
| R | | ... |
| T | | ... |
| U |---|--------------------------------+ 0x80000000
| A | | Memory Mapped Files |
| L | 2 | ... |
| | G |--------------------------------+ 0x42000000
| A | B | Slot 32 Process 32 |
| D | |--------------------------------+ 0x40000000
| D | U | ... |
| R | S |--------------------------------+ 0x08000000
| E | E | Slot 3 DEVICE.EXE |
| S | R |--------------------------------+ 0x06000000
| S | | Slot 2 FILESYS.EXE |
| | |--------------------------------+ 0x04000000
| | | Slot 1 XIP DLLs |
| | |--------------------------------+ 0x02000000
| | | Slot 0 Current Process |
+---+---+--------------------------------+ 0x00000000

+---+------------------------------------+ 0x02000000
| | DLL Virtual Memory Allocations |
| S | +--------------------------------|
| L | | ROM DLLs:R/W Data |
| O | |--------------------------------|
| T | | RAM DLL+OverFlow ROM DLL: |
| 0 | | Code+Data |
| | +--------------------------------|
| C +------+-----------------------------|
| U | A |
| R V | |
| R +-------------------------+----------|
| E | General Virtual Memory Allocations|
| N | +--------------------------------|
| T | | Process VirtualAlloc() calls |
| | |--------------------------------|
| P | | Thread Stack |
| R | |--------------------------------|
| O | | Process Heap |
| C | |--------------------------------|
| E | | Thread Stack |
| S |---+--------------------------------|
| S | Process Code and Data |
| |------------------------------------+ 0x00010000
| | Guard Section(64K)+UserKInfo |
+---+------------------------------------+ 0x00000000

Reg# APCS Meaning
R0 a1 Working registers
R1 a2 "
R2 a3 "
R3 a4 "
R4 v1 Must be preserved
R5 v2 "
R6 v3 "
R7 v4 "
R8 v5 "
R9 v6 "
R10 sl Stack Limit
R11 fp Frame Pointer
R12 ip
R13 sp Stack Pointer
R14 lr Link Register
R15 pc Program Counter

31 28| 8 7 6 5| 4 0
N Z C V| I F T| mode

ADD r0, r1, r2 ; r0 := r1 + r2
ADC r0, r1, r2 ; r0 := r1 + r2 + C
SUB r0, r1, r2 ; r0 := r1 - r2
SBC r0, r1, r2 ; r0 := r1 - r2 + C - 1
RSB r0, r1, r2 ; r0 := r2 - r1
RSC r0, r1, r2 ; r0 := r2 - r1 + C - 1

AND r0, r1, r2 ; r0 := r1 and r2
ORR r0, r1, r2 ; r0 := r1 or r2
EOR r0, r1, r2 ; r0 := r1 xor r2
BIC r0, r1, r2 ; r0 := r1 and not r2

MOV r0, r2 ; r0 := r2
MVN r0, r2 ; r0 := not r2

CMP r1, r2 ; set cc on r1 - r2
CMN r1, r2 ; set cc on r1 + r2
TST r1, r2 ; set cc on r1 and r2
TEQ r1, r2 ; set cc on r1 or r2

ADD r3, r2, r1, LSL #3 ; r3 := r2 + 8*r1
ADD r5, r5, r3, LSL r2 ; r5 += 2r2*r3

ADDS r4,r2,r0 ; 32-bit carry-out -> C
ADC r5,r3,r1 ; added into top 32 bits

MUL r4, r3, r2 ; r4 := (r3 *r2)[31:0]

MLA r4, r3, r2, r1 ; r4 := (r3*r2+r1)[31:0]

Opcode Mnemonic Meaning Effect
[24:21]
0000 AND Logical bit-wise AND Rd:= Rn AND Op2
0001 EOR Logical bit-wise exclusive OR Rd:= Rn EOR Op2
0010 SUB Subtract Rd:= Rn - Op2
0011 RSB Reverse subtract Rd:= Op2 - Rn
0100 ADD Add Rd:= Rn + Op2
0101 ADC Add with carry Rd:= Rn + Op2 + C
0110 SBC Subtract with carry Rd:= Rn - Op2 + C - 1
0111 RSC Reverse subtract with carry Rd:= Op2 - Rn + C - 1
1000 TST Test Scc on Rn AND Op2
1001 TEQ Test equivalence Scc on Rn EOR Op2
1010 CMP Compare Scc on Rn - Op2
1011 CMN Compare negated Scc on Rn + Op2
1100 OPR Logical bit-wise OR Rd:= Rn OR Op2
1101 MOV Move Rd:= Op2
1110 BIC Bit clear Rd:= Rn AND NOT Op2
1111 MVN Move negated Rd:= NOT Op2