title: Values of Registers at Windows 10 Entry Point x64
body: <p>I recently wrote a small program that simply displays a popup dialog box using the winapi. I started it in x64dbg debugger to see how it was compiled and learn a bit about assembly.</p>
  <p>The first thing that I noticed was that the main thread does not start executing at the entry point of my code: it starts executing somewhere in <code>ntdll.dll</code>. This code seems to make several function calls before eventually calling <code>kernel32</code> which calls the entry point.</p>
  <p>At the entry point, the registers have some values already loaded. I know they must be important as zeroing them in the debugger causes my program to crash. <code>rax</code> seems to be loaded with the entry point, but I'm not sure what the values of the others do.</p>
  <p>So what exactly does all of the code do before my entry point, and what values does it load into the registers?</p>