Use this reference when an instruction in your own resettable lab is unfamiliar. Start with its plain-English meaning, then follow its worked trace. You can change the inputs; nothing needs to be memorized or completed before continuing.
These examples use 32-bit x86, Intel syntax: destination first. A label such as [gold] stands for a valid address in our fictional game. It is not an address to paste into another process. The forms below cover common general-purpose uses, rather than every encoding or special-register form.
The authoritative details are in Intel’s Software Developer’s Manuals, especially Volume 2. The links in this table open the relevant entry in revision 093 of the instruction reference. A mnemonic names an operation; it does not identify one fixed opcode or instruction length.
Section: Find an operation.
In the forms below, reg means a register, imm means a number encoded in the instruction, and r/m means either a register or a memory operand. Memory uses brackets. The operand widths must match the selected instruction form; byte ptr, word ptr, and dword ptr make one, two, or four bytes explicit.
Section: Addressing: base + index times scale + displacement.
An expression such as [e s i+e c x*4+8] identifies a location. e s i is the base, e c x is an index, 4 is the scale, and 8 is the displacement, a fixed extra distance in bytes. In these usual 32-bit addressing forms, the encoded scale is 1, 2, 4, or 8; some base/index combinations have encoding restrictions.
With base hexadecimal 1 0 0 0, index 2, and a scale of 4, the address is hexadecimal 1 0 0 0 + 2 times 4 + 8 equals hexadecimal 1 0 1 0. A mov with this memory source reads bytes there. A lea with the same expression only calculates the address.
Addresses do not declare record sizes. If each player occupies 16 bytes, an index must advance by 16 bytes per player, perhaps by an earlier multiplication. Also distinguish operand size from address size: reading a four-byte field does not mean that four bytes make up the whole object.
Code note: Brackets name a location; the surrounding instruction tells you whether that location is read, written, or only calculated. An offset is evidence about a field, not proof of its name or type.
Section: Flags: four different questions.
Many integer operations update bits in e f l a g s. The trace panels use these names:
CF and OF answer different questions. Adding one to this value wraps the 32-bit result to zero and sets CF, while signed minus 1 + 1 fits and does not set OF. Adding one to this value sets OF because signed the large number shown does not fit, while the unsigned sum fits and does not set CF.
Some entries also mention PF: it reports even parity in the low result byte for these integer operations. AF records carry or borrow from bit 3 into bit 4. These two exist even when a game rule does not use them. An undefined flag is not an answer you may rely on; it is not a promise of zero. A preserved flag still describes an earlier operation.
In brief: Track which instruction most recently wrote the flag you need. A later copy may preserve a useful comparison; a later arithmetic operation may replace it.
Section: Copies and addresses.
Section: mov.
Meaning: copy a value from the source to the destination, leaving the source available.
Common forms: mov reg, reg/imm/memory, mov memory, reg/imm. Ordinary mov does not copy memory directly to memory. Effects: write the destination register or memory at the selected width; leave arithmetic flags unchanged.
Code example. The surrounding prose explains this example; the full lesson contains the exact code.
Takeaway: a copy can change a destination without changing its source or the last comparison.
Section: lea.
Meaning: calculate the effective address described by the source expression.
Common form: lea reg, [base+index*scale+displacement]. Effects: write a register; do not read the addressed game bytes or change arithmetic flags. It can also serve as arithmetic when the expression is useful as a number.
Code example. The surrounding prose explains this example; the full lesson contains the exact code.
Takeaway: computing where a field would be does not prove that a live, valid object exists there.
Section: Arithmetic and boundaries.
Section: add.
Meaning: add the source to the destination and keep the selected-width result.
Common forms: add reg, r/m/imm, add memory, reg/imm. Effects: write the destination and set OF, SF, ZF, AF, CF, and PF from the addition. The C P U, central processing unit, does not automatically reject an overflowing game reward.
Code example. The surrounding prose explains this example; the full lesson contains the exact code.
Takeaway: the result bits and overflow flags are separate pieces of evidence.
Section: sub.
Meaning: subtract the source from the destination and keep the selected-width result.
Common forms: sub reg, r/m/imm, sub memory, reg/imm. Effects: write the destination and set OF, SF, ZF, AF, CF, and PF. For subtraction, CF reports an unsigned borrow.
Code example. The surrounding prose explains this example; the full lesson contains the exact code.
Takeaway: subtraction alone does not enforce affordability; look for the check and branch that guard it.
Section: inc.
Meaning: add one to the destination.
Common form: inc r/m. Effects: write the operand and update OF, SF, ZF, AF, and PF, while preserving CF. It differs from add ..., 1 when later code needs carry.
Code example. The surrounding prose explains this example; the full lesson contains the exact code.
Takeaway: the carry flag after inc belongs to earlier code.
Section: dec.
Meaning: subtract one from the destination.
Common form: dec r/m. Effects: write the operand and update OF, SF, ZF, AF, and PF, while preserving CF. Zero can become the unsigned maximum if no guard prevents it.
Code example. The surrounding prose explains this example; the full lesson contains the exact code.
Takeaway: a preserved CF is not a fresh underflow test for the decrement.
Section: imul.
Meaning: multiply signed integers.
Common 32-bit forms: imul r/m32 writes the full product to e d x:e a x; imul reg32, r/m32 multiplies the destination by the source; imul reg32, r/m32, imm multiplies the source by the immediate. The latter two keep the low 32 bits in the named register. Effects: CF and OF tell whether that low result represents the full signed product; SF, ZF, AF, and PF are undefined. No source memory is written by these forms.
Code example. The surrounding prose explains this example; the full lesson contains the exact code.
Takeaway: check the form before assuming which registers hold the product.
Section: idiv.
Meaning: divide a signed double-width dividend by the source, producing a quotient and a remainder.
Common 32-bit form: idiv r/m32 divides e d x:e a x by that register or memory value; the quotient goes to e a x, the remainder to e d x. There is no immediate-divisor form. cdq first sign-extends a signed e a x into e d x:e a x. Effects: quotient truncates toward zero; arithmetic flags are undefined. A zero divisor or a quotient that does not fit raises a divide-error exception rather than an overflow flag. The trace models the zero-divisor case; signed-minimum divided by minus 1 is another failing boundary.
Code example. The surrounding prose explains this example; the full lesson contains the exact code.
Clarification: For 32-bit division, stale e d x bits change the dividend even when e a x looks correct. Signed division needs sign extension; unsigned div usually needs a different preparation.
Takeaway: identify the implicit dividend, validate the divisor, and make a new comparison before relying on flags.
Section: Widening a field.
Section: movzx.
Meaning: copy a smaller value into a wider register and fill the added high bits with zero.
Common forms here: movzx reg32, r/m8 or movzx reg32, r/m16. Effects: write only the wider destination; preserve flags and source memory. Byte FF becomes 000000FF, numeric 255.
Code example. The surrounding prose explains this example; the full lesson contains the exact code.
Takeaway: zero extension preserves the value of a small unsigned field.
Section: movsx.
Meaning: copy a smaller signed value into a wider register while repeating its sign bit into the added high bits.
Common forms here: movsx reg32, r/m8 or movsx reg32, r/m16. Effects: write only the wider destination; preserve flags and source memory. Byte FF becomes FFFFFFFF, signed minus 1.
Code example. The surrounding prose explains this example; the full lesson contains the exact code.
Takeaway: widening the same source byte with a different rule can change its meaning.
Section: Cheatsheet.
Next, follow decisions, stack operations, and bits. For numeric formats before these instructions, revisit How Bytes Become Numbers and Pointers.