title: LEA instruction opcode generation
body: <p>This question is <em>not</em> about LEA instruction, not about how it works at all, it is not a duplicate. This is about <em>OPCODE generation</em> for this instruction.</p>
  
  <p>What is the operand number in LEA opcode?</p>
  
  <p>Here is my "hello world.fasm":</p>
  
  <p><strong>Assembler program</strong>:</p>
  
  <pre><code>format ELF64 executable at 0000000100000000h    ; put image over 32-bit limit
  
  segment readable executable
  
  entry $
  
      mov edx,msg_size    ; CPU zero extends 32-bit operation to 64-bit
                  ; we can use less bytes than in case mov rdx,...
      lea rsi,[msg]
      mov edi,1       ; STDOUT
      mov eax,1       ; sys_write
      syscall
  
      xor edi,edi     ; exit code 0
      mov eax,60      ; sys_exit
      syscall
  
  segment readable writeable
  
  
  msg db 'Hello 64-bit world!',0xA
  
  msg_size = $-msg
  </code></pre>
  
  <p><strong>Hex dump</strong>:</p>
  
  <pre><code>000000b0  ba 14 00 00 00 48 8d 35  15 10 00 00 bf 01 00 00  |.....H.5........|
  000000c0  00 b8 01 00 00 00 0f 05  31 ff b8 3c 00 00 00 0f  |........1..&lt;....|
  000000d0  05 48 65 6c 6c 6f 20 36  34 2d 62 69 74 20 77 6f  |.Hello 64-bit wo|
  000000e0  72 6c 64 21 0a                                    |rld!.|
  000000e5
  </code></pre>
  
  <p>As you can see, the instruction of interest <code>lea rsi, [msg]</code> has the opcodes: <code>48 8d 35 15 10 00 00</code>. From the CPU instruction reference I can tell that <code>48</code> is the 64 bit prefix of sort, <code>8d</code> is the <code>LEA</code> code, <code>35</code> is destination register <code>rsi</code> reference, and <code>15 10 00 00</code> is...??? What is it?</p>
  
  <p><code>0x15</code> is <code>21</code> in decimal, and I can count with a finger tracking the hex dump that "Hello world" message is exactly 21 bytes after the <code>LEA rsi, [msg]</code> instruction. So it must be a relative address, but where <code>10 00 00</code> comes from? I would understand if it was <code>15</code> <strong>00</strong> <code>00 00</code>, but for some reason it is <code>15</code> <strong>01</strong> <code>00 00</code>.</p>
  
  <p>Unfortunately CPU references are not very helpful, they are so formal and I cannot get on terms with them. They look like this:</p>
  
  <pre><code>8D  r   LEA Gvqp    M   gen datamov Load Effective Address
  </code></pre>
  
  <p>So please explain how the <code>LEA</code> opcode is generated in this case, and if possible in general.</p>