X86常见指令

In 64-bit mode, the instruction’s default operation size is 32 bits. Use of the REX.R prefix permits access to additional
registers (R8-R15). Use of the REX.W prefix promotes operation to 64 bits. See the summary chart at the
beginning of this section for encoding data and limits.

e8 call 16/32
e9 32
ea 48
eb 8
9a call 48

64位跳转指令,仍然是目的地址减去源地址
00007FF6700416AE call qword ptr [__imp_GetTickCount64 (07FF670050000h)]
00007FF6700416B4 mov qword ptr [c],rax

ff 25 xxxxxxxx
jmp dword ptr ds:[xxxxxxxx]

ff 15 xxxxxxxx
call dword ptr ds:[xxxxxxxx]

jz 1bc == 0f 84 xx xx xx xx(xx xx xx xx == dst - current ip - 6 )
jnz 1bc == 0f 85 xx xx xx xx(xx xx xx xx == dst - current ip - 6 )

jz 74(-128-127)
jnz 75(-128-127)

90:nop
9b:wait
d6:这里尤其指明的是\xd6指令, 在intel手册上没查到对应什么指令,但在linux下和windows下发现系统对于这个是继续

0x8b 0xff ==mov edi,edi

局部变量在堆栈中是按照从高到低的顺序排列的，第一个变量在地址最高的地方，最后一个变量在地址最低的位置