EAX

All stubs from ntdll. dll start with the line MOV EAX, ServiceIndex, which applies to any version and flavour of Windows NT.

After a few simple tests, the actual system call is invoked using the system_call_table and index contained in eax.

The code at BE allocates the memory from the heap for the Singleton object and stores a pointer to that memory in eax.

This table, shown in Figure 2, uses the index provided in eax to identify which system call to invoke from the table (sys_call_table).

The next line, C3, takes the pointer in eax and stores it back into the instance reference at memory location 049388C8.

The input to cpuid (the variable "op" ) is passed to "asm" in the eax register, as cpuid expects it to.

Larger structures are returned in the EAX register as pointers to hidden return structures.

A value of 1 (for the Linux exit system call) is stored in EAX to request that the program exit.

Thus ?x serves here as both input and output register.

And since ?x is specified in the clobbered list, GCC doesn't use it anywhere else to store data.

The service code is present in the EAX register.

Unless this is done, GCC assumes that ?x and ?x are free, and it may decide to use them for storing other data.

The first two lines of assembly code at B0 and B5 load the instance reference from memory location 049388C8 into eax and test for null.

The CPU chooses the AL, AX, or EAX register depending on the width of the operand (8, 16, or 32 bits).

While lodsl modifies ?x, the lodsl and stosl instructions use it implicitly.

And here you can see another constraint that uses the two registers ?x and ?x to combine two 32-bit values and generate a 64-bit value