Operand address in Capstone disassembly is not the same as in IDA/HIEW

Question

I'm trying to disassembly x64 executable (dll) using Capstone. But operand address returned by it doesn't match disassembly from IDA/HIEW.

Here is the machine code:

0x48, 0x8D, 0x0D, 0xED, 0x44, 0x01, 0x00

In IDA/HIEW the disassembly is:

lea  rcx,[0000148F8]

But by using Capstone (with PowerShell bindings) I get different address 0x144ed:

Get-CapstoneDisassembly -Architecture CS_ARCH_X86 -Mode CS_MODE_64 -Bytes (
    0x48, 0x8D, 0x0D, 0xED, 0x44, 0x01, 0x00
) -Address 0x1800000004096 -Detailed

Size     : 7
Address  : 0x180001000
Mnemonic : lea
Operands : rcx, qword ptr [rip + 0x144ed]
Bytes    : {72, 141, 13, 237, 68, 1, 0, 148, 204, 148, 0, 17, 0, 128, 0, 0}
RegRead  :
RegWrite :

You can verify this online by using Capstone.js and 488D0DED440100 as input.

I've also tried SharpDisasm, but result is the same:

lea rcx, [rip+0x144ed]

Could somebody help me to understand what's happening here?

Answer 1

This is RIP-relative addressing. Basically, it is adding 0x144ed to the address of the very next instruction - i.e. rcx = rip + 7 (since this instruction is 7 bytes) + 0x144ed. In IDA, that instruction is located at 0x404 so it is adding 0x144ed to (0x404+7) = 0x148f8