There are three different encodings for pop
depending on what you want to pop. If you want to pop a segment register, the encoding is 07
plus the number of the segment register shifted left by four places, so 07
for pop es
, 17
for pop ss
and 1f
for pop ds
. The instruction pop cs
used to have opcode 0f
, but this was removed in the 80186 processor. It is now the prefix for two-byte instructions. You cannot pop cs
anymore. To pop fs
or gs
, use opcodes 0f a1
for pop fs
and 0f a9
for pop gs
.
If you want to pop a general purpose register, the encoding is 58
plus the number of the register. The size of the register is 16 bits in a 16 bit operation mode, 32 bit in a 32 bit operation mode or 64 bit in a 64 bit operation mode. It can be changed with a 66
. In 64 bit mode, the high bit of the register number also goes into an optional REX prefix.
If you want to pop into a memory location, the encoding is 8f /0
, i.e. opcode 8f
with a modr/m byte where the register field holds value 0
.
Refer to the manual for details. (e.g. https://www.felixcloutier.com/x86/pop, or the full Intel PDF it was extracted from)