


04 ib     ADD AL,imm8          2        Add immediate byte to AL
05 id     ADD EAX,imm32        2        Add immediate dword to EAX
05 iw     ADD AX,imm16         2        Add immediate word to AX
0C  ib       OR AL,imm8        2         OR immediate byte to AL
0D  id       OR EAX,imm32      2         OR immediate dword to EAX
0D  iw       OR AX,imm16       2         OR immediate word to AX
0F  00 /0   SLDT r/m16    pm=2/2      Store LDTR to EA word
0F  00 /1     STR r/m16     pm=23/27     Load EA word into task register
0F  00 /2   LLDT r/m16       20       Load selector r/m16 into LDTR
0F  00 /3    LTR r/m16      pm=23/27  Load EA word into task register
0F  00 /4    VERR r/m16    pm=10/11    Set ZF=1 if segment can be read,
0F  00 /5    VERW r/m16    pm=15/16    Set ZF=1 if segment can be written,
0F  01 /0    SGDT m        9        Store GDTR to m
0F  01 /1    SIDT m        9        Store IDTR to m
0F  01 /2    LGDT m16&32      11            Load m into GDTR
0F  01 /3    LIDT m16&32      11            Load m into IDTR
0F  01 /4   SMSW r/m16      2/3,pm=2/2      Store machine status word to EA
0F  01 /6   LMSW r/m16       10/13    Load r/m16 in machine status word
0F  02 /r     LAR r16,r/m16    pm=15/16    r16 := r/m16 masked by FF00
0F  02 /r     LAR r32,r/m32    pm=15/16    r32 := r/m32 masked by 00FxFF00
0F  03 /r    LSL r16,r/m16    pm=20/21    Load: r16 := segment limit,
0F  03 /r    LSL r32,r/m32    pm=20/21    Load: r32 := segment limit,
0F  20 /r   MOV r32,CR0/CR2/CR3   6        Move (control register) to
0F  22 /r   MOV CR0/CR2/CR3,r32   10/4/5   Move (register) to (control
0F  93   SETAE r/m8   4/5     Set byte if above or equal (CF=0)
0F  97   SETA r/m8    4/5     Set byte if above (CF=0 and ZF=0)
0F  A3         BT r/m16,r16    3/12      Save bit in carry flag
0F  A3         BT r/m32,r32    3/12      Save bit in carry flag
0F  A4   SHLD r/m16,r16,imm8  3/7      r/m16 gets SHL of r/m16 concatenated
0F  A4   SHLD r/m32,r32,imm8  3/7      r/m32 gets SHL of r/m32 concatenated
0F  AB        BTS r/m16,r16   6/13    Save bit in carry flag and set
0F  AB        BTS r/m32,r32   6/13    Save bit in carry flag and set
0F  AC   SHRD r/m16,r16,imm8   3/7     r/m16 gets SHR of r/m16 concatenated
0F  AC   SHRD r/m32,r32,imm8   3/7     r/m32 gets SHR of r/m32 concatenated
0F  B2 /r   LSS r16,m16:16   7,p=22   Load SS:r16 with pointer from memory
0F  B3        BTR r/m16,r16   6/13    Save bit in carry flag and reset
0F  B3        BTR r/m32,r32   6/13    Save bit in carry flag and reset
0F  B6 /r   MOVZX r16,r/m8     3/6      Move byte to word with zero-extend
0F  B6 /r   MOVZX r32,r/m8     3/6      Move byte to dword, zero-extend
0F  B7 /r   MOVZX r32,r/m16    3/6      Move word to dword, zero-extend
0F  BA /4 ib   BT r/m16,imm8   3/6       Save bit in carry flag
0F  BA /5 ib  BTS r/m16,imm8  6/8     Save bit in carry flag and set
0F  BA /6 ib  BTR r/m16,imm8  6/8     Save bit in carry flag and reset
0F  BA /6 ib  BTR r/m32,imm8  6/8     Save bit in carry flag and reset
0F  BA /7 ib  BTC r/m16,imm8  6/8     Save bit in carry flag and complement
0F  BB        BTC r/m16,r16   6/13    Save bit in carry flag and complement
0F  BB        BTC r/m32,r32   6/13    Save bit in carry flag and complement
0F  BC    BSF r16,r/m16        10+3n     Bit scan forward on r/m word
0F  BC    BSF r32,r/m32        10+3n     Bit scan forward on r/m dword
0F  BD    BSR r16,r/m16        10+3n     Bit scan reverse on r/m word
0F  BD    BSR r32,r/m32        10+3n     Bit scan reverse on r/m dword
0F  BE /r  MOVSX r16,r/m8     3/6      Move byte to word with sign-extend
0F  BE /r  MOVSX r32,r/m8     3/6      Move byte to dword, sign-extend
0F  BF /r  MOVSX r32,r/m16    3/6      Move word to dword, sign-extend
14 ib     ADC AL,imm8      2         Add with carry immediate byte to AL
15 id     ADC EAX,imm32    2         Add with carry immediate dword to EAX
15 iw     ADC AX,imm16     2         Add with carry immediate word to AX
1C  ib       SBB AL,imm8       2       Subtract with borrow immediate byte
24 ib     AND AL,imm8          2         AND immediate byte to AL
25 id     AND EAX,imm32        2         AND immediate dword to EAX
25 iw     AND AX,imm16         2         AND immediate word to AX
   26H    ES segment override prefix
27        DAA                4        Decimal adjust AL after addition
2C  ib      SUB AL,imm8      2        Subtract immediate byte from AL
2D  id      SUB EAX,imm32    2        Subtract immediate dword from EAX
2D  iw      SUB AX,imm16     2        Subtract immediate word from AX
   2EH    CS segment override prefix
2F        DAS                4        Decimal adjust AL after subtraction
34  ib      XOR AL,imm8      2        Exclusive-OR immediate byte to AL
35  id      XOR EAX,imm32    2        Exclusive-OR immediate dword to EAX
35  iw      XOR AX,imm16     2        Exclusive-OR immediate word to AX
   36H    SS segment override prefix
37        AAA            4         ASCII adjust AL after addition
3C  ib          CMP AL,imm8        2        Compare immediate byte to AL
3D  iw          CMP AX,imm16       2        Compare immediate word to AX
   3EH    DS segment override prefix
3F        AAS            4         ASCII adjust AL after subtraction
50 + /r    PUSH r16      2        Push register word
58 + rw     POP r16       4          Pop top of stack into word register
60      PUSHA        18       Push AX, CX, DX, BX, original SP, BP, SI, and
60      PUSHAD       18       Push EAX, ECX, EDX, EBX, original ESP, EBP,
61       POPA          24       Pop DI, SI, BP, SP, BX, DX, CX, and AX
61       POPAD         24       Pop EDI, ESI, EBP, ESP, EDX, ECX, and EAX
62 /r     BOUND r16,m16&16     10        Check if r16 is within bounds
62 /r     BOUND r32,m32&32     10        Check if r32 is within bounds
63 /r     ARPL r/m16,r16       pm=20/21  Adjust RPL of r/m16 to not
   64H    FS segment override prefix
   65H    GS segment override prefix
   66H    Operand-size override
   67H    Address-size override
6C      INS r/m8,DX    15,pm=9*/29**  Input byte from port DX into ES:(E)DI
6D      INS r/m16,DX   15,pm=9*/29**  Input word from port DX into ES:(E)DI
6D      INS r/m32,DX   15,pm=9*/29**  Input dword from port DX into ES:(E)DI
6E       OUTS DX,r/m8    14,pm=8*/28**   Output byte [(E)SI] to port in DX
6F       OUTS DX,r/m16   14,pm=8*/28**   Output word [(E)SI] to port in DX
6F       OUTS DX,r/m32   14,pm=8*/28**   Output dword [(E)SI] to port in DX
77  cb         JA rel8           7+m,3    Jump short if above (CF=0 and
80 /4 ib  AND r/m8,imm8        2/7       AND immediate byte to r/m byte
88  /r   MOV r/m8,r8       2/2           Move byte register to r/m byte
89  /r   MOV r/m16,r16     2/2           Move word register to r/m word
8D  /r  LEA r16,m    2       Store effective address for m in register r16
8D  /r  LEA r32,m    2       Store effective address for m in register r32
8F   /0     POP m16       5          Pop top of stack into memory word
8F   /0     POP m32       5          Pop top of stack into memory dword
90      NOP           3         No operation
90 + r    XCHG AX,r16      3          Exchange word register with AX
90 + r    XCHG EAX,r32     3          Exchange dword register with EAX
90 + r    XCHG r16,AX      3          Exchange word register with AX
98        CBW             3               AX := sign-extend of AL
98        CWDE            3               EAX := sign-extend of AX
99        CDQ                2        EDX:EAX := sign-extend of EAX
99        CWD                2        DX:AX := sign-extend of AX
9B       WAIT          6 min.     Wait until BUSY pin is inactive (HIGH)
9C      PUSHF        4        Push FLAGS
9C      PUSHFD       4        Push EFLAGS
9D       POPF          5        Pop top of stack FLAGS
9D       POPFD         5        Pop top of stack into EFLAGS
9E      SAHF         3        Store AH into flags SF ZF xx AF xx PF xx CF
9F      LAHF          2        Load: AH := flags SF ZF xx AF xx PF xx CF
A4      MOVS m8,m8       7        Move byte [(E)SI] to ES:[(E)DI]
A5      MOVS m16,m16     7        Move word [(E)SI] to ES:[(E)DI]
A5      MOVS m32,m32     7        Move dword [(E)SI] to ES:[(E)DI]
A6        CMPS m8,m8         10       Compare bytes ES:[(E)DI] (second
A8   ib      TEST AL,imm8      2        AND immediate byte with AL
A9   id      TEST EAX,imm32    2        AND immediate dword with EAX
A9   iw      TEST AX,imm16     2        AND immediate word with AX
AA      STOS m8      4        Store AL in byte ES:[(E)DI], update (E)DI
AB      STOS m16     4        Store AX in word ES:[(E)DI], update (E)DI
AB      STOS m32     4        Store EAX in dword ES:[(E)DI], update (E)DI
AC      LODS m8       5        Load byte [(E)SI] into AL
AD      LODS m16      5        Load word [(E)SI] into AX
AD      LODS m32      5        Load dword [(E)SI] into EAX
AE      SCAS m8      7       Compare bytes AL-ES:[DI], update (E)DI
AF      SCAS m16     7       Compare words AX-ES:[DI], update (E)DI
AF      SCAS m32     7       Compare dwords EAX-ES:[DI], update (E)DI
C3         RET          10+m           Return (near) to caller
C5  /r      LDS r16,m16:16   7,p=22   Load DS:r16 with pointer from memory
C5  /r      LDS r32,m16:32   7,p=22   Load DS:r32 with pointer from memory
C8 iw 00    ENTER imm16,0      10         Make procedure stack frame
C8 iw 01    ENTER imm16,1      12         Make stack frame for procedure
C9      LEAVE        4       Set ESP to EBP, then pop EBP
C9      LEAVE        4       Set SP to BP, then pop BP
CB         RET          18+m,pm=32+m   Return (far) to caller, same
CC        INT 3        33              Interrupt 3--trap to debugger
CC        INT 3        pm=59           Interrupt 3--Protected Mode, same
CF      IRET         22,pm=38     Interrupt return (far return and pop
CF      IRET         pm=82        Interrupt return to lesser privilege
D0   /4         SAL r/m8,1        3/7     Multiply r/m byte by 2, once
D0  /2       RCL r/m8,1        9/10    Rotate 9 bits (CF,r/m byte) left
D2   /4         SAL r/m8,CL       3/7     Multiply r/m byte by 2, CL times
D4 0A     AAM            17        ASCII adjust AX after multiply
D5 0A     AAD            19        ASCII adjust AX before division
D7    XLAT m8    5     Set AL to memory byte DS:[(E)BX + unsigned AL]
D7    XLATB      5     Set AL to memory byte DS:[(E)BX + unsigned AL]
E1  cb   LOOPE rel8   11+m    DEC count; jump short if count <> 0 and ZF=1
E1  cb   LOOPZ rel8   11+m    DEC count; jump short if count <> 0 and ZF=1
E2  cb   LOOP rel8    11+m    DEC count; jump short if count <> 0
E4  ib    IN AL,imm8    12,pm=6*/26**     Input byte from immediate port
E5  ib    IN AX,imm8    12,pm=6*/26**     Input word from immediate port
E6  ib    OUT imm8,AL     10,pm=4*/24**   Output byte AL to immediate port
E7  ib    OUT imm8,AX     10,pm=4*/24**   Output word AL to immediate port
E9  cw    JMP rel16       7+m             Jump near, displacement relative
EB  cb    JMP rel8        7+m             Jump short
F0      LOCK         0       Assert LOCK# signal for the next instruction
F13     STI           3        Set interrupt flag; interrupts enabled at the
F3  6C    REP INS r/m8, DX    13+6*(E)CX,  
F4          HLT                5          Halt
F5        CMC            2        Complement carry flag
F6   /2   NOT r/m8       2/6      Reverse each bit of r/m byte
F6  /3  NEG r/m8      2/6       Two's complement negate r/m byte
F6  /4  MUL AL,r/m8     9-14/12-17   Unsigned multiply (AX := AL * r/m byte)
F6  /5      IMUL r/m8              9-14/12-17  AX= AL * r/m byte
F6 /6     DIV AL,r/m8        14/17    Unsigned divide AX by r/m byte
F6 /7       IDIV r/m8          19       Signed divide AX by r/m byte
F7   /2   NOT r/m16      2/6      Reverse each bit of r/m word
F7   /2   NOT r/m32      2/6      Reverse each bit of r/m dword
F7  /3  NEG r/m16     2/6       Two's complement negate r/m word
F7  /3  NEG r/m32     2/6       Two's complement negate r/m dword
F7  /4  MUL AX,r/m16    9-22/12-25   Unsigned multiply (DX:AX := AX * r/m
F7  /5      IMUL r/m16             9-22/12-25  DX:AX := AX * r/m word
F7 /6     DIV AX,r/m16       22/25    Unsigned divide DX:AX by r/m
F7 /7       IDIV AX,r/m16      27       Signed divide DX:AX by EA word
F8        CLC             2               Clear carry flag
F9          STC             2           Set carry flag
FA        CLI            3        Clear interrupt flag; interrupts disabled
FC        CLD             2        Clear direction flag; SI and DI
FD      STD           2         Set direction flag so (E)SI and/or (E)DI
FE  /0      INC r/m8                       Increment r/m byte by 1
FE /1     DEC r/m8           2/6      Decrement r/m byte by 1
FF   /6    PUSH m16      5        Push memory word
FF   /6    PUSH m32      5        Push memory dword
FF  /0      INC r/m16                      Increment r/m word by 1
FF  /6      INC r/m32                      Increment r/m dword by 1
FF /1     DEC r/m16          2/6      Decrement r/m word by 1


OF  06    CLTS           5        Clear task-switched flag




  17.2.2.1 Opcode

   The "Opcode" column gives the complete object code produced for each
   form of the instruction. When possible, the codes are given as
   hexadecimal bytes, in the same order in which they appear in memory.
   Definitions of entries other than hexadecimal bytes are as follows:

   /digit:
          (digit is between 0 and 7) indicates that the ModR/M byte of
          the instruction uses only the r/m (register or memory) operand.
          The reg field contains the digit that provides an extension to
          the instruction's opcode.

   /r:
          indicates that the ModR/M byte of the instruction contains both
          a register operand and an r/m operand.

   cb, cw, cd, cp:
          a 1-byte (cb), 2-byte (cw), 4-byte (cd) or 6-byte (cp) value
          following the opcode that is used to specify a code offset and
          possibly a new value for the code segment register.

   ib, iw, id:
          a 1-byte (ib), 2-byte (iw), or 4-byte (id) immediate operand to
          the instruction that follows the opcode, ModR/M bytes or
          scale-indexing bytes. The opcode determines if the operand is a
          signed value. All words and doublewords are given with the
          low-order byte first.

   +rb, +rw, +rd:
          a register code, from 0 through 7, added to the hexadecimal
          byte given at the left of the plus sign to form a single opcode
          byte. The codes are

      rb         rw         rd
    AL = 0     AX = 0     EAX = 0
    CL = 1     CX = 1     ECX = 1
    DL = 2     DX = 2     EDX = 2
    BL = 3     BX = 3     EBX = 3
    AH = 4     SP = 4     ESP = 4
    CH = 5     BP = 5     EBP = 5
    DH = 6     SI = 6     ESI = 6
    BH = 7     DI = 7     EDI = 7


