title: Why do we use sub esp, 4 instead of push a register in assembly?
body: <p>If we use </p>
  
  <pre><code>push ecx
  </code></pre>
  
  <p>we should use one byte in the opcode, if we use</p>
  
  <pre><code>sub esp, 4 
  </code></pre>
  
  <p>I think we should use 2 bytes? I've tried to read <a href="https://c9x.me/x86/html/file_module_x86_id_308.html" rel="nofollow noreferrer">the documentation</a> but I didn't understand much.
  The reason is the same as in</p>
  
  <pre><code>xor eax, eax 
  </code></pre>
  
  <p>instead of </p>
  
  <pre><code>mov eax, 0
  </code></pre>