Summary

• Assembly is the reverse engineer's ground truth; we use Intel syntax.
• 16 GP registers with 64/32/16/8-bit views; RIP and RFLAGS drive control flow.
• Operands: immediate, register, memory [base+index*scale+disp].
• lea = address math; xor reg,reg = zero; cmp+jcc = branches.
• if/while compile to cmp/test + conditional jumps.
• System V (RDI, RSI, ...) vs Microsoft x64 (RCX, RDX, ...) — know the platform.
• Practice in Ghidra + GDB; recognize loops, switches, strings, and API calls.