title: does windows handle the opcode different?
body: <p>(btw this ist my first question here, so I dont know any guidelines)</p>
  <p>Im trying to learn reading the pure opcodes (I do not know the exact term) of Programms on x-86-architectur (intel i5-7400) but if I look at an .exe-file there are huge rows with the same (hexadicimal) numbers and it doesnt make much sense. Last I created a .exe-file from a simple .cpp-file with the gnu compiler on the cmd. It doesnt make thrifty things but writes a word in the console and ask a word from the user to write in the console:</p>
  <pre><code>#include&lt;iostream&gt;
  
  int main(int argc,char*argv[]){
      std::cout&lt;&lt;&quot;aaahhhhhhhhh&quot;&lt;&lt;std::endl;
      char a;
      std::cin&gt;&gt;a;
      return 0;
  }
  </code></pre>
  <p>the .exe-file looks as follows in binary form:
  4d 5a 90 20 03 20 20 20 04 20 20 20 ff ff 20 20 b8 20 20 20 20 20 20 20 40 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 80 20 20 20 0e 1f ba 0e 20 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 20 20 20 20 20 20 20 50 45 20 20 64 86 13 20 24 97 09 62 20 86 01 20 b6 05 20 20 f0 20 26 20 0b 02 02 25 20 18 20 20 20 40 20 20 20 02 20 20 d0 14 20 20 20 10 20 20 20 20 20 40 01 20 20 20 20 10 20 20 20 02 20 20 04 20 20 20 20 20 20 20 05 20 02 20 20 20 20 20 20 40 02 20 20 06 20 20 cf ea 02 20 03 20 60 01 20 20 20 20 20 20 20 20 20 10 20 20 20 20 20 20
  ...</p>
  <p>and is very long of course (there is much left).</p>
  <p>I was reading the first lines. As you can see (or let traduce; I took this to examine if I was correct and if I wasnt it was always the more correct one: <a href="https://defuse.ca/online-x86-assembler.htm#disassembly2" rel="nofollow noreferrer">the link</a>) it first pops the r10 from the stack. In the rex byte 01001101 the 3th bit is set, but not used because there isnt any modrm byte in this kind of the pop-operation. Then the opcodes make strange thing with and and the register and it do not look like instruction but like a queue of numbers. There are nops and many false opcodes interrupts. So I now wonder, how this comes since the code starts with the first bit. Below it begins to do what it have to but the first lines? Why?</p>
  <pre><code>
  0:  4d 5a                   rex.WRB pop r10
  2:  90                      nop
  3:  20 03                   and    BYTE PTR [rbx],al
  5:  20 20                   and    BYTE PTR [rax],ah
  7:  20 04 20                and    BYTE PTR [rax+riz*1],al
  a:  20 20                   and    BYTE PTR [rax],ah
  c:  ff                      (bad)
  d:  ff 20                   jmp    QWORD PTR [rax]
  f:  20 b8 20 20 20 20       and    BYTE PTR [rax+0x20202020],bh
  15: 20 20                   and    BYTE PTR [rax],ah
  17: 20 40 20                and    BYTE PTR [rax+0x20],al
  1a: 20 20                   and    BYTE PTR [rax],ah
  1c: 20 20                   and    BYTE PTR [rax],ah
  1e: 20 20                   and    BYTE PTR [rax],ah
  20: 20 20                   and    BYTE PTR [rax],ah
  22: 20 20                   and    BYTE PTR [rax],ah
  24: 20 20                   and    BYTE PTR [rax],ah
  26: 20 20                   and    BYTE PTR [rax],ah
  28: 20 20                   and    BYTE PTR [rax],ah
  2a: 20 20                   and    BYTE PTR [rax],ah
  2c: 20 20                   and    BYTE PTR [rax],ah
  2e: 20 20                   and    BYTE PTR [rax],ah
  30: 20 20                   and    BYTE PTR [rax],ah
  32: 20 20                   and    BYTE PTR [rax],ah
  34: 20 20                   and    BYTE PTR [rax],ah
  36: 20 20                   and    BYTE PTR [rax],ah
  38: 20 20                   and    BYTE PTR [rax],ah
  3a: 20 20                   and    BYTE PTR [rax],ah
  3c: 80 20 20                and    BYTE PTR [rax],0x20
  3f: 20 0e                   and    BYTE PTR [rsi],cl
  41: 1f                      (bad)
  42: ba 0e 20 b4 09          mov    edx,0x9b4200e
  47: cd 21                   int    0x21
  49: b8 01 4c cd 21          mov    eax,0x21cd4c01
  4e: 54                      push   rsp
  4f: 68 69 73 20 70          push   0x70207369
  54: 72 6f                   jb     0xc5
  56: 67 72 61                addr32 jb 0xba
  59: 6d                      ins    DWORD PTR es:[rdi],dx
  5a: 20 63 61                and    BYTE PTR [rbx+0x61],ah
  5d: 6e                      outs   dx,BYTE PTR ds:[rsi]
  5e: 6e                      outs   dx,BYTE PTR ds:[rsi]
  5f: 6f                      outs   dx,DWORD PTR ds:[rsi]
  60: 74 20                   je     0x82
  62: 62                      (bad)
  63: 65 20 72 75             and    BYTE PTR gs:[rdx+0x75],dh
  67: 6e                      outs   dx,BYTE PTR ds:[rsi]
  68: 20 69 6e                and    BYTE PTR [rcx+0x6e],ch
  6b: 20 44 4f 53             and    BYTE PTR [rdi+rcx*2+0x53],al
  6f: 20 6d 6f                and    BYTE PTR [rbp+0x6f],ch
  72: 64 65 2e 0d 0d 0a 24    fs gs cs or eax,0x20240a0d
  79: 20
  7a: 20 20                   and    BYTE PTR [rax],ah
  7c: 20 20                   and    BYTE PTR [rax],ah
  7e: 20 20                   and    BYTE PTR [rax],ah
  80: 50                      push   rax
  81: 45 20 20                and    BYTE PTR [r8],r12b
  84: 64 86 13                xchg   BYTE PTR fs:[rbx],dl
  87: 20 24 97                and    BYTE PTR [rdi+rdx*4],ah
  8a: 09 62 20                or     DWORD PTR [rdx+0x20],esp
  8d: 86 01                   xchg   BYTE PTR [rcx],al
  8f: 20 b6 05 20 20 f0       and    BYTE PTR [rsi-0xfdfdffb],dh
  95: 20 26                   and    BYTE PTR [rsi],ah
  97: 20 0b                   and    BYTE PTR [rbx],cl
  99: 02 02                   add    al,BYTE PTR [rdx]
  9b: 25 20 18 20 20          and    eax,0x20201820
  a0: 20 40 20                and    BYTE PTR [rax+0x20],al
  a3: 20 20                   and    BYTE PTR [rax],ah
  a5: 02 20                   add    ah,BYTE PTR [rax]
  a7: 20 d0                   and    al,dl
  a9: 14 20                   adc    al,0x20
  ab: 20 20                   and    BYTE PTR [rax],ah
  ad: 10 20                   adc    BYTE PTR [rax],ah
  af: 20 20                   and    BYTE PTR [rax],ah
  b1: 20 20                   and    BYTE PTR [rax],ah
  b3: 40 01 20                rex add DWORD PTR [rax],esp
  b6: 20 20                   and    BYTE PTR [rax],ah
  b8: 20 10                   and    BYTE PTR [rax],dl
  ba: 20 20                   and    BYTE PTR [rax],ah
  bc: 20 02                   and    BYTE PTR [rdx],al
  be: 20 20                   and    BYTE PTR [rax],ah
  c0: 04 20                   add    al,0x20
  c2: 20 20                   and    BYTE PTR [rax],ah
  c4: 20 20                   and    BYTE PTR [rax],ah
  c6: 20 20                   and    BYTE PTR [rax],ah
  c8: 05 20 02 20 20          add    eax,0x20200220
  cd: 20 20                   and    BYTE PTR [rax],ah
  cf: 20 20                   and    BYTE PTR [rax],ah
  d1: 40 02 20                add    spl,BYTE PTR [rax]
  d4: 20 06                   and    BYTE PTR [rsi],al
  d6: 20 20                   and    BYTE PTR [rax],ah
  d8: cf                      iret
  d9: ea                      (bad)
  da: 02 20                   add    ah,BYTE PTR [rax]
  dc: 03 20                   add    esp,DWORD PTR [rax]
  de: 60                      (bad)
  df: 01 20                   add    DWORD PTR [rax],esp
  e1: 20 20                   and    BYTE PTR [rax],ah
  e3: 20 20                   and    BYTE PTR [rax],ah
  e5: 20 20                   and    BYTE PTR [rax],ah
  e7: 20 20                   and    BYTE PTR [rax],ah
  e9: 10 20                   adc    BYTE PTR [rax],ah
  eb: 20 20                   and    BYTE PTR [rax],ah
  ed: 20 20                   and    BYTE PTR [rax],ah
  ef: 20 20                   and    BYTE PTR [rax],ah
  f1: 20 10                   and    BYTE PTR [rax],dl
  f3: 20 20                   and    BYTE PTR [rax],ah
  f5: 20 20                   and    BYTE PTR [rax],ah
  f7: 20 20                   and    BYTE PTR [rax],ah
  f9: 10 20                   adc    BYTE PTR [rax],ah
  fb: 20 20                   and    BYTE PTR [rax],ah
  fd: 20 20                   and    BYTE PTR [rax],ah
  ff: 20                      .byte 0x20
  </code></pre>