+----------------------------------------+ 0xFFFFFFFF
|   |   |  Kernel Virtual Address:       |
|   | 2 |  KPAGE Trap Area,              |
|   | G |  KDataStruct, etc              |
|   | B |  ...                           |
|   |   |--------------------------------+ 0xF0000000
| 4 | K |  Static Mapped Virtual Address |
| G | E |  ...                           |
| B | R |  ...                           |
|   | N |--------------------------------+ 0xC4000000
| V | E |  NK.EXE                        |
| I | L |--------------------------------+ 0xC2000000
| R |   |  ...                           |
| T |   |  ...                           |
| U |---|--------------------------------+ 0x80000000
| A |   |  Memory Mapped Files           |
| L | 2 |  ...                           |
|   | G |--------------------------------+ 0x42000000
| A | B |  Slot 32 Process 32            |
| D |   |--------------------------------+ 0x40000000
| D | U |  ...                           |
| R | S |--------------------------------+ 0x08000000
| E | E |  Slot 3  DEVICE.EXE            |
| S | R |--------------------------------+ 0x06000000
| S |   |  Slot 2  FILESYS.EXE           |
|   |   |--------------------------------+ 0x04000000
|   |   |  Slot 1  XIP DLLs              |
|   |   |--------------------------------+ 0x02000000
|   |   |  Slot 0  Current Process       |
+---+---+--------------------------------+ 0x00000000

+---+------------------------------------+ 0x02000000
|   |     DLL Virtual Memory Allocations |
| S |   +--------------------------------|
| L |   |  ROM DLLs:R/W Data             |
| O |   |--------------------------------|
| T |   |  RAM DLL+OverFlow ROM DLL:     |
| 0 |   |  Code+Data                     |
|   |   +--------------------------------|
| C +------+-----------------------------|
| U        |                  A          |
| R        V                  |          |
| R +-------------------------+----------|
| E |  General Virtual Memory Allocations|
| N |   +--------------------------------|
| T |   |  Process VirtualAlloc() calls  |
|   |   |--------------------------------|
| P |   |       Thread Stack             |
| R |   |--------------------------------|
| O |   |       Process Heap             |
| C |   |--------------------------------|
| E |   |       Thread Stack             |
| S |---+--------------------------------|
| S |      Process Code and Data         |
|   |------------------------------------+ 0x00010000
|   |    Guard Section(64K)+UserKInfo    |
+---+------------------------------------+ 0x00000000

Reg#		APCS	    		Meaning
R0		a1 			Working registers
R1 		a2 			"
R2 		a3 			"
R3 		a4 			"
R4 		v1 			Must be preserved
R5 		v2 			"
R6 		v3 			"
R7 		v4 			"
R8 		v5 			"
R9 		v6 			"
R10		sl 			Stack Limit
R11		fp 			Frame Pointer
R12		ip 	 
R13		sp 			Stack Pointer
R14		lr 			Link Register
R15		pc 			Program Counter

31    28|                               8 7 6 5| 4   0 
 N Z C V|                                 I F T| mode

ADD 	r0, r1, r2 			; r0 := r1 + r2
ADC 	r0, r1, r2 			; r0 := r1 + r2 + C
SUB 	r0, r1, r2 			; r0 := r1 - r2
SBC 	r0, r1, r2 			; r0 := r1 - r2 + C - 1
RSB 	r0, r1, r2 			; r0 := r2 - r1
RSC 	r0, r1, r2 			; r0 := r2 - r1 + C - 1

AND 	r0, r1, r2 			; r0 := r1 and r2
ORR 	r0, r1, r2 			; r0 := r1 or r2
EOR 	r0, r1, r2 			; r0 := r1 xor r2
BIC 	r0, r1, r2 			; r0 := r1 and not r2

MOV 	r0, r2 				; r0 := r2
MVN 	r0, r2 				; r0 := not r2

CMP 	r1, r2 				; set cc on r1 - r2
CMN 	r1, r2 				; set cc on r1 + r2
TST 	r1, r2 				; set cc on r1 and r2
TEQ 	r1, r2 				; set cc on r1 or r2

ADD 	r3, r2, r1, LSL #3 	; r3 := r2 + 8*r1
ADD 	r5, r5, r3, LSL r2 	; r5 += 2r2*r3

ADDS 	r4,r2,r0 			; 32-bit carry-out -> C
ADC 	r5,r3,r1 			; added into top 32 bits

MUL 	r4, r3, r2 			; r4 := (r3 *r2)[31:0]

MLA 	r4, r3, r2, r1 		; r4 := (r3*r2+r1)[31:0]

Opcode 	Mnemonic Meaning Effect
[24:21]
0000 	AND 	Logical bit-wise AND Rd:= Rn AND Op2
0001 	EOR 	Logical bit-wise exclusive OR Rd:= Rn EOR Op2
0010 	SUB 	Subtract Rd:= Rn - Op2
0011 	RSB 	Reverse subtract Rd:= Op2 - Rn
0100 	ADD 	Add Rd:= Rn + Op2
0101 	ADC 	Add with carry Rd:= Rn + Op2 + C
0110 	SBC 	Subtract with carry Rd:= Rn - Op2 + C - 1
0111 	RSC 	Reverse subtract with carry Rd:= Op2 - Rn + C - 1
1000 	TST 	Test Scc on Rn AND Op2
1001 	TEQ 	Test equivalence Scc on Rn EOR Op2
1010 	CMP 	Compare Scc on Rn - Op2
1011 	CMN 	Compare negated Scc on Rn + Op2
1100 	OPR 	Logical bit-wise OR Rd:= Rn OR Op2
1101 	MOV 	Move Rd:= Op2
1110 	BIC 	Bit clear Rd:= Rn AND NOT Op2
1111 	MVN 	Move negated Rd:= NOT Op2

LDR 	r0, [r1] 		; r0 := mem [r1]
	STR 	r0, [r1] 		; mem [r1] := r0
	LDR 	r0,[r1, #4] 		; r0 := mem[r1+4]

LDRB 	r0, [r1] 		; r0 := mem [r1] [7:0]
STRB 	r0, [r1] 		; mem [r1] [7:0] := r0

LDR r0, [r1], #4 		; r0 := mem[r1]
				; r1 := r1 + 4

LDMIA 	r1,{r0, r2, r5} 	; r0 := mem [r1]
				; r2 := mem [r1+4]
				; r5 := mem [r1+8]

STMFD   SP!, {R4-R6,LR}		; Lưu giá trị R4, R5 & LR 
					; vào stack, trừ SP đi 4 x 4 = 0x10
SUB     SP, SP, #0x24			; Dành 0x24 bytes cho local vars
....
ADD     SP, SP, #0x24			; Phục hồi trạng thái stack
LDMFD   SP!, {R4-R6,PC}		; Phục hồi thanh ghi R4, R6, trả về địa chỉ sau khi gọi BL vào thanh ghi PC (R15)

SWP      Rd, Rm, [Rn]

B	LABEL

MOV r0, #0		; initialize counter
LOOP: 	...
		ADD r0, r0, #1		; increment counter
		CMP r0, #10	 	; compare with limit
		BNE LOOP 		; repeat if not equal
		... 			; else continue

Branch		Interpretation 			Normal Uses
--------------------------------------------------------------
B 		Unconditional 			Always take this branch
BAL 		Always 				Always take this branch
BEQ 		Equal 				Comparison equal or zero result
BNE 		Not equal 			Comparison not equal or zero result
BPL 		Plus 				Result positive or zero
BMI 		Minus 				Result minus or negative
BCC 		Carry clear 			Arithmetic operation did not give carry-out
BLO 		Lower 				Unsigned comparison gave lower
BCS 		Carry 				set Arithmetic operation gave carry-out
BHS 		Higher or same 			Unsigned comparison gave higher or same
BVC 		Overflow clear 			Signed integer operation ; no overflow occurred
BVS 		Overflow set 			Signed integer operation ; overflow occurred
BGT 		Greater than 			Signed integer comparison gave greater than
BGE 		Greater or equal 		Signed integer comparison gave greater or equal
BLT 		Less than 			Signed integer comparison gave less than
BLE 		Less or equal 			Signed integer comparison gave less than or equal
BHI 		Higher 				Unsigned comparison gave highe
BLS 		Lower or same 			Unsigned comparison gave lower or same

CMP	r0, #5 		; if (r0 != 5) {
ADDNE	r1, r1, r0 	; 	r1 := r1 + r0 - r2
SUBNE	r1, r1, r2 	; }

Opcode	 	Mnemonic 	Interpretation 				Status flag state
[31:28]  	extension 						for execution					 	 
----------------------------------------------------------------------------------
0000 		EQ 		Equal / equals zero 			Zset 	 
0001 		NE 		Not equal 				Zclear 	 
0010 		CS/HS 		Carry set / unsigned higher or same 	Cset 	 
0011 		CC/LO 		Carry clear / unsigned lower 		Cclear 	 
0100 		MI 		Minus / negative 			Nset 	 
0101 		Pl 		Plus / positive or zero 		Nclear 	 
0110 		VS 		Overflow				Vset 	 
0111 		VC 		No overflow 				Vclear 	 
1000 		HI 		Unsigned higher 			Cset and Zclear 	 
1001 		LS 		Unsigned lower or same 			Cclear or Zset 	 
1010 		GE 		Signed greater than or equal 		N equals V 	 
1011 		LT 		Signed less than 			N is not Equal to V 	 
1100 		GT 		Signed greater than 			Z clear and N equals V 	 
1101 		LE 		Signed less than or equal 		Z set or Nis not equal to 	 
1110 		AL 		Always 					any 	 
1111 		NV 		Never (do not use!) 			none

BL 	SUBR 		; branch to SUBR
	... 			; return to here
SUBR 	... 			; subroutine entry point
	MOV pc, r14 		; return

BL SUB1 			; branch to SUB1
	...
SUB1 	STMDA r13!, {r0-r2, r14}	; save regs
	BL SUB2
	...
	LDMIB r13!, {r0-r2, pc}		; restore regs + return
SUB2 	...
	MOV pc, r14 			; return

.text:00107DB8    LDR     R1, =aClsid			; lpSubKey = "CLSID"
.text:00107DBC    MOV     R6, R0			
.text:00107DC0    STR     R3, [SP,#0x34+var_34]	;STR R3,[SP]; phkResult
.text:00107DC4    MOV     R3, #0			; samDesired = 0
.text:00107DC8    MOV     R2, #0			; ulOptions = 0
.text:00107DCC    MOV     R0, #0x80000000		; hKey = HKEY_CLASS_ROOT
.text:00107DD0    BL      RegOpenKeyExW
.text:00107DD4    MOVS    R3, R0			; test operation result
.text:00107DD8    BEQ     _OpenFailed

Command	Hex
B		xxxxxxEA
BEQ		xxxxxx0A
BNE		xxxxxx1A
BGE		xxxxxxAA
BHI		xxxxxx8A
BLT		xxxxxxBA
BCC		xxxxxx3A
BCS		xxxxxx2A
BPL		xxxxxx5A
BMI		xxxxxx4A
BLS		xxxxxx9A
BGT		xxxxxxCA
BLE		xxxxxxDA

if (sub_116F0() == 0)
	//Incorrect key
else
	//Correct Key