diff --git a/test/db/asm/x86_16 b/test/db/asm/x86_16
index 2dbb56da8d..4adac85b77 100644
--- a/test/db/asm/x86_16
+++ b/test/db/asm/x86_16
@@ -5,27 +5,27 @@ ad "aam" d40a 0x0 (seq (set temp_al (cast 8 false (var ax))) (set ax (| (& (var
 ad "aam 0x42" d442 0x0 (seq (set temp_al (cast 8 false (var ax))) (set ax (| (& (var ax) (~ (bv 16 0xff00))) (<< (cast 16 false (div (var temp_al) (bv 8 0x42))) (bv 8 0x8) false))) (set adjusted (mod (var temp_al) (bv 8 0x42))) (set ax (| (& (var ax) (~ (bv 16 0xff))) (cast 16 false (var adjusted)))) (set _result (var adjusted)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
 ad "aas" 3f 0x0 (seq (branch (|| (! (ule (& (cast 8 false (var ax)) (bv 8 0xf)) (bv 8 0x9))) (var af)) (seq (set ax (- (var ax) (bv 16 0x6))) (set ax (| (& (var ax) (~ (bv 16 0xff00))) (<< (cast 16 false (- (cast 8 false (>> (var ax) (bv 8 0x8) false)) (bv 8 0x1))) (bv 8 0x8) false))) (set af true) (set cf true)) (seq (set af false) (set cf false))) (set ax (| (& (var ax) (~ (bv 16 0xff))) (cast 16 false (& (cast 8 false (var ax)) (bv 8 0xf))))))
 adB "cbw" 98
-d "call 0" e8fdff 0x0 (seq (set _cs (cast 16 false (var cs))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var _cs))) (set _pc (bv 16 0x0)) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var _pc))))
+d "call 0" e8fdff 0x0 (seq (set _cs (cast 16 false (var cs))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var _cs))) (set _pc (bv 16 0x3)) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var _pc))) (jmp (bv 16 0x0)))
 d "enter 8, 0" c8080000 0x0 (seq (set _alloc_sz (cast 16 false (bv 16 0x8))) (set _nest_lvl (mod (cast 8 false (bv 16 0x0)) (bv 8 0x20))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var bp))) (set _frame_tmp (var sp)) (branch (is_zero (var _nest_lvl)) nop (seq (branch (! (ule (var _nest_lvl) (bv 8 0x1))) (seq (set _itr (bv 8 0x1)) (repeat (&& (ule (var _itr) (var _nest_lvl)) (! (== (var _itr) (var _nest_lvl)))) (seq (set bp (- (var bp) (bv 16 0x2))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (loadw 0 16 (var bp)))) (set _itr (+ (var _itr) (bv 8 0x1)))))) nop) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var _frame_tmp))))) (set sp (- (var sp) (cast 16 false (var _alloc_sz)))) (set bp (cast 16 false (cast 15 false (var _frame_tmp)))))
-a "jmp 0x0" ebfe 0x0 (jmp (+ (bv 16 0x0) (bv 16 0x0)))
-a "jmp 0x10" eb0e 0x0 (jmp (+ (bv 16 0x0) (bv 16 0x10)))
-a "jmp 0x34" eb32 0x0 (jmp (+ (bv 16 0x0) (bv 16 0x34)))
-a "jne 0x14" 7512 0x0 (branch (! (var zf)) (jmp (+ (bv 16 0x0) (bv 16 0x14))) nop)
-a "jnz 0x94" 660f858d000000 0x0 (branch (! (var zf)) (jmp (+ (bv 16 0x0) (bv 16 0x94))) nop)
-a "jnz -0x94" 660f8565ffffff 0x0 (branch (! (var zf)) (jmp (+ (bv 16 0x0) (bv 16 0xff6c))) nop)
-a "jno -0x34" 71ca 0x0 (branch (! (var of)) (jmp (+ (bv 16 0x0) (bv 16 0xffcc))) nop)
+a "jmp 0x0" ebfe 0x0 (jmp (cast 16 false (bv 16 0x0)))
+a "jmp 0x10" eb0e 0x0 (jmp (cast 16 false (bv 16 0x10)))
+a "jmp 0x34" eb32 0x0 (jmp (cast 16 false (bv 16 0x34)))
+a "jne 0x14" 7512 0x0 (branch (! (var zf)) (jmp (bv 16 0x14)) nop)
+a "jnz 0x94" 660f858d000000 0x0 (branch (! (var zf)) (jmp (bv 16 0x94)) nop)
+a "jnz -0x94" 660f8565ffffff 0x0 (branch (! (var zf)) (jmp (bv 16 0xff6c)) nop)
+a "jno -0x34" 71ca 0x0 (branch (! (var of)) (jmp (bv 16 0xffcc)) nop)
 dB "jmp 0xfec50" e95bec
-d "jmp 0x1fec50" e95bec 0x1ffff2 (jmp (+ (bv 16 0xfff2) (bv 16 0xec50)))
+d "jmp 0xec50" e95bec 0x1ffff2 (jmp (cast 16 false (bv 16 0xec50)))
 ad "leave" c9 0x0 (seq (set sp (var bp)) (set sp (+ (var sp) (bv 16 0x2))) (set bp (loadw 0 16 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)))))
-ad "loop 0xff92" e290 0x0 (seq (set cx (- (var cx) (bv 16 0x1))) (branch (! (is_zero (var cx))) (jmp (bv 16 0xff92)) nop))
+ad "loop 0xff92" e290 0x0 (seq (set cx (- (var cx) (bv 16 0x1))) (branch (! (is_zero (var cx))) (jmp (bv 16 0xff94)) nop))
 a "mov al, [0xbeef]" a0efbe 0x0 (set ax (| (& (var ax) (~ (bv 16 0xff))) (cast 16 false (loadw 0 8 (bv 16 0xbeef)))))
 a "mov ax, [0xbeef]" a1efbe 0x0 (set ax (loadw 0 16 (bv 16 0xbeef)))
 d "popf" 9d 0x0 (seq (set _flags (loadw 0 16 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)))) (set cf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set pf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set af (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set zf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set sf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set tf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set if (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set df (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set of (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x3) false)) (set nt (lsb (var _flags))) (set sp (+ (var sp) (bv 16 0x2))))
 ad "push ax" 50 0x0 (seq (set sp (- (var sp) (bv 16 0x4))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var ax))))
 d "pushf" 9c 0x0 (seq (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (ite false (bv 16 0x1) (bv 16 0x0)) (bv 16 0x1) false) (ite (var nt) (bv 16 0x1) (bv 16 0x0))) (bv 16 0x2) false) (bv 16 0x3)) (bv 16 0x1) false) (ite (var of) (bv 16 0x1) (bv 16 0x0))) (bv 16 0x1) false) (ite (var df) (bv 16 0x1) (bv 16 0x0))) (bv 16 0x1) false) (ite (var if) (bv 16 0x1) (bv 16 0x0))) (bv 16 0x1) false) (ite (var tf) (bv 16 0x1) (bv 16 0x0))) (bv 16 0x1) false) (ite (var zf) (bv 16 0x1) (bv 16 0x0))) (bv 16 0x1) false) (ite (var zf) (bv 16 0x1) (bv 16 0x0))) (bv 16 0x2) false) (ite (var af) (bv 16 0x1) (bv 16 0x0))) (bv 16 0x2) false) (ite (var pf) (bv 16 0x1) (bv 16 0x0))) (bv 16 0x1) false) (bv 16 0x1)) (bv 16 0x1) false) (ite (var cf) (bv 16 0x1) (bv 16 0x0))))))
 d "pushaw" 60 0x0 (seq (set _sp (var sp)) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var ax))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var cx))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var dx))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var bx))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var _sp))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var bp))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var si))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var di))))
-a "test bl, 0x12" f6c312 0x0 (seq (set _res (& (cast 8 false (var bx)) (bv 8 0x12))) (set bx (| (& (var bx) (~ (bv 16 0xff))) (cast 16 false (var _res)))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-a "test bx, 0x1234" f7c33412 0x0 (seq (set _res (& (var bx) (bv 16 0x1234))) (set bx (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+a "test bl, 0x12" f6c312 0x0 (seq (set _res (& (cast 8 false (var bx)) (bv 8 0x12))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+a "test bx, 0x1234" f7c33412 0x0 (seq (set _res (& (var bx) (bv 16 0x1234))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
 aB "test byte [bx], 0x12" f60712
 aB "test word [bx], 0x1234" f7073412
 a "xlatb" d7 0x0 (set ax (| (& (var ax) (~ (bv 16 0xff))) (cast 16 false (loadw 0 8 (+ (+ (+ (var bx) (bv 16 0x0)) (<< (cast 16 false (var ds)) (bv 8 0x4) false)) (cast 16 false (cast 8 false (var ax))))))))
diff --git a/test/db/asm/x86_32 b/test/db/asm/x86_32
index 7f1d67c357..0b2309c82b 100644
--- a/test/db/asm/x86_32
+++ b/test/db/asm/x86_32
@@ -182,41 +182,41 @@ d "invd" 0f08
 d "invlpg byte [eax]" 0f0138
 d "iret" 66cf 0x0 empty
 d "iretd" CF
-d "ja 2" 7700 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-d "ja 6" 0f8700000000 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-d "jae 2" 7300 0x0 (branch (! (var cf)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-d "jae 6" 0f8300000000 0x0 (branch (! (var cf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-d "jb 2" 7200 0x0 (branch (var cf) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-d "jb 6" 0f8200000000 0x0 (branch (var cf) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-d "jbe 2" 7600 0x0 (branch (|| (var cf) (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-d "jbe 6" 0f8600000000 0x0 (branch (|| (var cf) (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-d "je 2" 7400 0x0 (branch (var zf) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-d "je 6" 0f8400000000 0x0 (branch (var zf) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-d "jg 2" 7f00 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-d "jg 6" 0f8f00000000 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-d "jge 2" 7d00 0x0 (branch (! (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-d "jge 6" 0f8d00000000 0x0 (branch (! (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-d "jl 2" 7c00 0x0 (branch (^^ (var sf) (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-d "jl 6" 0f8c00000000 0x0 (branch (^^ (var sf) (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-d "jle 2" 7e00 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-d "jle 6" 0f8e00000000 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
+d "ja 2" 7700 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (bv 32 0x2)) nop)
+d "ja 6" 0f8700000000 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (bv 32 0x6)) nop)
+d "jae 2" 7300 0x0 (branch (! (var cf)) (jmp (bv 32 0x2)) nop)
+d "jae 6" 0f8300000000 0x0 (branch (! (var cf)) (jmp (bv 32 0x6)) nop)
+d "jb 2" 7200 0x0 (branch (var cf) (jmp (bv 32 0x2)) nop)
+d "jb 6" 0f8200000000 0x0 (branch (var cf) (jmp (bv 32 0x6)) nop)
+d "jbe 2" 7600 0x0 (branch (|| (var cf) (var zf)) (jmp (bv 32 0x2)) nop)
+d "jbe 6" 0f8600000000 0x0 (branch (|| (var cf) (var zf)) (jmp (bv 32 0x6)) nop)
+d "je 2" 7400 0x0 (branch (var zf) (jmp (bv 32 0x2)) nop)
+d "je 6" 0f8400000000 0x0 (branch (var zf) (jmp (bv 32 0x6)) nop)
+d "jg 2" 7f00 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (bv 32 0x2)) nop)
+d "jg 6" 0f8f00000000 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (bv 32 0x6)) nop)
+d "jge 2" 7d00 0x0 (branch (! (^^ (var sf) (var of))) (jmp (bv 32 0x2)) nop)
+d "jge 6" 0f8d00000000 0x0 (branch (! (^^ (var sf) (var of))) (jmp (bv 32 0x6)) nop)
+d "jl 2" 7c00 0x0 (branch (^^ (var sf) (var of)) (jmp (bv 32 0x2)) nop)
+d "jl 6" 0f8c00000000 0x0 (branch (^^ (var sf) (var of)) (jmp (bv 32 0x6)) nop)
+d "jle 2" 7e00 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (bv 32 0x2)) nop)
+d "jle 6" 0f8e00000000 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (bv 32 0x6)) nop)
 d "jmp 3" 66EB00
-d "jne 2" 7500 0x0 (branch (! (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-d "jne 6" 0f8500000000 0x0 (branch (! (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-d "jno 2" 7100 0x0 (branch (! (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-d "jno 6" 0f8100000000 0x0 (branch (! (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-d "jnp 2" 7b00 0x0 (branch (! (var pf)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-d "jnp 6" 0f8b00000000 0x0 (branch (! (var pf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-d "jns 2" 7900 0x0 (branch (! (var sf)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-d "jns 6" 0f8900000000 0x0 (branch (! (var sf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-d "jo 2" 7000 0x0 (branch (var of) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-d "jo 6" 0f8000000000 0x0 (branch (var of) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-d "jp 2" 7a00 0x0 (branch (var pf) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-d "jp 6" 0f8a00000000 0x0 (branch (var pf) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-d "js 2" 7800 0x0 (branch (var sf) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-d "js 6" 0f8800000000 0x0 (branch (var sf) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-d "jecxz 0x72" e308 0x68 (branch (is_zero (var ecx)) (jmp (+ (bv 32 0x68) (bv 32 0x72))) nop)
-d "jcxz 0x4d" 67e308 0x42 (branch (is_zero (cast 16 false (var ecx))) (jmp (+ (bv 32 0x42) (bv 32 0x4d))) nop)
+d "jne 2" 7500 0x0 (branch (! (var zf)) (jmp (bv 32 0x2)) nop)
+d "jne 6" 0f8500000000 0x0 (branch (! (var zf)) (jmp (bv 32 0x6)) nop)
+d "jno 2" 7100 0x0 (branch (! (var of)) (jmp (bv 32 0x2)) nop)
+d "jno 6" 0f8100000000 0x0 (branch (! (var of)) (jmp (bv 32 0x6)) nop)
+d "jnp 2" 7b00 0x0 (branch (! (var pf)) (jmp (bv 32 0x2)) nop)
+d "jnp 6" 0f8b00000000 0x0 (branch (! (var pf)) (jmp (bv 32 0x6)) nop)
+d "jns 2" 7900 0x0 (branch (! (var sf)) (jmp (bv 32 0x2)) nop)
+d "jns 6" 0f8900000000 0x0 (branch (! (var sf)) (jmp (bv 32 0x6)) nop)
+d "jo 2" 7000 0x0 (branch (var of) (jmp (bv 32 0x2)) nop)
+d "jo 6" 0f8000000000 0x0 (branch (var of) (jmp (bv 32 0x6)) nop)
+d "jp 2" 7a00 0x0 (branch (var pf) (jmp (bv 32 0x2)) nop)
+d "jp 6" 0f8a00000000 0x0 (branch (var pf) (jmp (bv 32 0x6)) nop)
+d "js 2" 7800 0x0 (branch (var sf) (jmp (bv 32 0x2)) nop)
+d "js 6" 0f8800000000 0x0 (branch (var sf) (jmp (bv 32 0x6)) nop)
+d "jecxz 0x72" e308 0x68 (branch (is_zero (var ecx)) (jmp (bv 32 0x72)) nop)
+d "jcxz 0x4d" 67e308 0x42 (branch (is_zero (cast 16 false (var ecx))) (jmp (bv 32 0x4d)) nop)
 d "lahf" 9f 0x0 (set eax (| (& (var eax) (~ (bv 32 0xff00))) (<< (cast 32 false (| (<< (| (<< (| (<< (| (<< (| (<< (ite (var sf) (bv 8 0x1) (bv 8 0x0)) (bv 8 0x1) false) (ite (var zf) (bv 8 0x1) (bv 8 0x0))) (bv 8 0x2) false) (ite (var af) (bv 8 0x1) (bv 8 0x0))) (bv 8 0x2) false) (ite (var pf) (bv 8 0x1) (bv 8 0x0))) (bv 8 0x1) false) (bv 8 0x1)) (bv 8 0x1) false) (ite (var cf) (bv 8 0x1) (bv 8 0x0)))) (bv 8 0x8) false)))
 d "lar eax, word [eax]" 0f0200
 d "lcall [0]" ff1c2500000000
@@ -239,9 +239,9 @@ d "lock and word fs:[bx + si], si" 646766f02130
 d "lodsb al, byte [esi]" ac 0x0 (seq (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (loadw 0 8 (+ (+ (var esi) (bv 32 0x0)) (<< (cast 32 false (var ds)) (bv 8 0x4) false)))))) (branch (var df) (set esi (- (var esi) (bv 32 0x1))) (set esi (+ (var esi) (bv 32 0x1)))))
 d "lodsd eax, dword [esi]" ad 0x0 (seq (set eax (loadw 0 32 (+ (+ (var esi) (bv 32 0x0)) (<< (cast 32 false (var ds)) (bv 8 0x4) false)))) (branch (var df) (set esi (- (var esi) (bv 32 0x4))) (set esi (+ (var esi) (bv 32 0x4)))))
 d "lodsd eax, dword [si]" 67ad 0x0 (seq (set eax (loadw 0 32 (+ (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x0)) (<< (cast 32 false (var ds)) (bv 8 0x4) false)))) (branch (var df) (set esi (| (& (var esi) (~ (bv 32 0xffff))) (cast 32 false (- (cast 16 false (var esi)) (bv 16 0x4))))) (set esi (| (& (var esi) (~ (bv 32 0xffff))) (cast 32 false (+ (cast 16 false (var esi)) (bv 16 0x4)))))))
-d "loop 3" 66e200 0x0 (seq (set ecx (- (var ecx) (bv 32 0x1))) (branch (! (is_zero (var ecx))) (jmp (bv 32 0x3)) nop))
-d "loope 3" 66e100 0x0 (seq (set ecx (- (var ecx) (bv 32 0x1))) (branch (&& (! (is_zero (var ecx))) (var zf)) (jmp (bv 32 0x3)) nop))
-d "loopne 3" 66e000 0x0 (seq (set ecx (- (var ecx) (bv 32 0x1))) (branch (&& (! (is_zero (var ecx))) (! (var zf))) (jmp (bv 32 0x3)) nop))
+d "loop 3" 66e200 0x0 (seq (set ecx (- (var ecx) (bv 32 0x1))) (branch (! (is_zero (var ecx))) (jmp (bv 32 0x6)) nop))
+d "loope 3" 66e100 0x0 (seq (set ecx (- (var ecx) (bv 32 0x1))) (branch (&& (! (is_zero (var ecx))) (var zf)) (jmp (bv 32 0x6)) nop))
+d "loopne 3" 66e000 0x0 (seq (set ecx (- (var ecx) (bv 32 0x1))) (branch (&& (! (is_zero (var ecx))) (! (var zf))) (jmp (bv 32 0x6)) nop))
 d "lsl eax, dword [eax]" 0f0300
 d "ltr ax" 0f00d8
 d "ltr word [eax]" 0f0018
@@ -500,15 +500,15 @@ d "syscall" 0f05
 d "sysenter" 0f34
 d "sysexit" 0f35
 d "sysret" 0f07
-d "test al, 0" a800 0x0 (seq (set _res (& (cast 8 false (var eax)) (bv 8 0x0))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _res)))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-d "test byte [eax], 0" f60000 0x0 (seq (set _res (& (loadw 0 8 (+ (var eax) (bv 32 0x0))) (bv 8 0x0))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-d "test byte [eax], 0" f60800 0x0 (seq (set _res (& (loadw 0 8 (+ (var eax) (bv 32 0x0))) (bv 8 0x0))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-d "test byte [eax], al" 8400 0x0 (seq (set _res (& (loadw 0 8 (+ (var eax) (bv 32 0x0))) (cast 8 false (var eax)))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-d "test dword [eax], 0" f70000000000 0x0 (seq (set _res (& (loadw 0 32 (+ (var eax) (bv 32 0x0))) (bv 32 0x0))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-d "test dword [eax], 0" f70000000000 0x0 (seq (set _res (& (loadw 0 32 (+ (var eax) (bv 32 0x0))) (bv 32 0x0))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-d "test dword [eax], 0" f70800000000 0x0 (seq (set _res (& (loadw 0 32 (+ (var eax) (bv 32 0x0))) (bv 32 0x0))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-d "test dword [eax], eax" 8500 0x0 (seq (set _res (& (loadw 0 32 (+ (var eax) (bv 32 0x0))) (var eax))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-d "test eax, 0" a900000000 0x0 (seq (set _res (& (var eax) (bv 32 0x0))) (set eax (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+d "test al, 0" a800 0x0 (seq (set _res (& (cast 8 false (var eax)) (bv 8 0x0))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+d "test byte [eax], 0" f60000 0x0 (seq (set _res (& (loadw 0 8 (+ (var eax) (bv 32 0x0))) (bv 8 0x0))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+d "test byte [eax], 0" f60800 0x0 (seq (set _res (& (loadw 0 8 (+ (var eax) (bv 32 0x0))) (bv 8 0x0))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+d "test byte [eax], al" 8400 0x0 (seq (set _res (& (loadw 0 8 (+ (var eax) (bv 32 0x0))) (cast 8 false (var eax)))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+d "test dword [eax], 0" f70000000000 0x0 (seq (set _res (& (loadw 0 32 (+ (var eax) (bv 32 0x0))) (bv 32 0x0))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+d "test dword [eax], 0" f70000000000 0x0 (seq (set _res (& (loadw 0 32 (+ (var eax) (bv 32 0x0))) (bv 32 0x0))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+d "test dword [eax], 0" f70800000000 0x0 (seq (set _res (& (loadw 0 32 (+ (var eax) (bv 32 0x0))) (bv 32 0x0))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+d "test dword [eax], eax" 8500 0x0 (seq (set _res (& (loadw 0 32 (+ (var eax) (bv 32 0x0))) (var eax))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+d "test eax, 0" a900000000 0x0 (seq (set _res (& (var eax) (bv 32 0x0))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
 d "ud2" 0f0b
 d "unpckhpd xmm0, xmmword [eax]" 660f1500
 d "unpcklpd xmm0, xmmword [eax]" 660f1400
@@ -1063,11 +1063,11 @@ aB "bt edx, 59" 0fbae23b
 aB "bt ebp, -20" 0fbae5e0
 aB "btr dword [eax], eax" 0fb300
 aB "bts dword [eax], eax" 0fab00
-a "call 0x8049100" e8fb900408 0x0 (seq (set _cs (cast 32 false (var cs))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _cs))) (set _pc (bv 32 0x0)) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _pc))))
-a "call 4" e8ffffffff 0x0 (seq (set _cs (cast 32 false (var cs))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _cs))) (set _pc (bv 32 0x0)) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _pc))))
-a "call 5" e800000000 0x0 (seq (set _cs (cast 32 false (var cs))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _cs))) (set _pc (bv 32 0x0)) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _pc))))
-a "call dword [eax]" ff10 0x0 (seq (set _cs (cast 32 false (var cs))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _cs))) (set _pc (bv 32 0x0)) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _pc))))
-a "call ebx" ffd3 0x0 (seq (set _cs (cast 32 false (var cs))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _cs))) (set _pc (bv 32 0x0)) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _pc))))
+a "call 0x8049100" e8fb900408 0x0 (seq (set _cs (cast 32 false (var cs))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _cs))) (set _pc (bv 32 0x5)) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _pc))) (jmp (bv 32 0x8049100)))
+a "call 4" e8ffffffff 0x0 (seq (set _cs (cast 32 false (var cs))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _cs))) (set _pc (bv 32 0x5)) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _pc))) (jmp (bv 32 0x4)))
+a "call 5" e800000000 0x0 (seq (set _cs (cast 32 false (var cs))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _cs))) (set _pc (bv 32 0x5)) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _pc))) (jmp (bv 32 0x5)))
+a "call dword [eax]" ff10 0x0 (seq (set _cs (cast 32 false (var cs))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _cs))) (set _pc (bv 32 0x2)) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _pc))) (jmp (loadw 0 32 (+ (var eax) (bv 32 0x0)))))
+a "call ebx" ffd3 0x0 (seq (set _cs (cast 32 false (var cs))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _cs))) (set _pc (bv 32 0x2)) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _pc))) (jmp (var ebx)))
 a "bnd call ebx" f2ffd3
 a "cbw" 6698
 a "cdq" 99
@@ -1271,42 +1271,42 @@ aB "invlpga" 0f01df
 aB "invlpg byte [eax]" 0f0138
 a "iret" 66cf
 a "iretd" cf
-a "ja 0x8049300" 0f87fa920408 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (+ (bv 32 0x0) (bv 32 0x8049300))) nop)
-a "ja 2" 7700 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-a "ja 6" 7704 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-a "jae 2" 7300 0x0 (branch (! (var cf)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-a "jae 6" 7304 0x0 (branch (! (var cf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-a "jb 0x8049300" 0f82fa920408 0x0 (branch (var cf) (jmp (+ (bv 32 0x0) (bv 32 0x8049300))) nop)
-a "jb 2" 7200 0x0 (branch (var cf) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-a "jb 6" 7204 0x0 (branch (var cf) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-a "jbe 2" 7600 0x0 (branch (|| (var cf) (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-a "jbe 6" 7604 0x0 (branch (|| (var cf) (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-a "je 2" 7400 0x0 (branch (var zf) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-a "je 6" 7404 0x0 (branch (var zf) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-a "jg 0x8049300" 0f8ffa920408 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (+ (bv 32 0x0) (bv 32 0x8049300))) nop)
-a "jg 2" 7f00 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-a "jg 6" 7f04 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-a "jge 0x8048010" 0f8d0a800408 0x0 (branch (! (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x8048010))) nop)
-a "jge 0x8049300" 0f8dfa920408 0x0 (branch (! (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x8049300))) nop)
-a "jge 2" 7d00 0x0 (branch (! (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-a "jge 6" 7d04 0x0 (branch (! (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-a "jl 0x8048010" 0f8c0a800408 0x0 (branch (^^ (var sf) (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x8048010))) nop)
-a "jl 0x8049300" 0f8cfa920408 0x0 (branch (^^ (var sf) (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x8049300))) nop)
-a "jl 2" 7c00 0x0 (branch (^^ (var sf) (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-a "jl 6" 7c04 0x0 (branch (^^ (var sf) (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-a "jle 0x8048010" 0f8e0a800408 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x8048010))) nop)
-a "jle 0x8049300" 0f8efa920408 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x8049300))) nop)
-a "jle 2" 7e00 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-a "jle 6" 7e04 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-a "jmp 0" ebfe 0x0 (jmp (+ (bv 32 0x0) (bv 32 0x0)))
-a "jmp 0x42" eb40 0x0 (jmp (+ (bv 32 0x0) (bv 32 0x42)))
-a "jmp -0x7e" eb80 0x0 (jmp (+ (bv 32 0x0) (bv 32 0xffffff82)))
-a "jmp -0x7f" e97cffffff 0x0 (jmp (+ (bv 32 0x0) (bv 32 0xffffff81)))
-a "jmp 0x8049200" e9fb910408 0x0 (jmp (+ (bv 32 0x0) (bv 32 0x8049200)))
-a "jmp 0x81" eb7f 0x0 (jmp (+ (bv 32 0x0) (bv 32 0x81)))
-a "jmp 0x82" e97d000000 0x0 (jmp (+ (bv 32 0x0) (bv 32 0x82)))
-a "jmp 2" eb00 0x0 (jmp (+ (bv 32 0x0) (bv 32 0x2)))
-a "jmp 3" eb01 0x0 (jmp (+ (bv 32 0x0) (bv 32 0x3)))
+a "ja 0x8049300" 0f87fa920408 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (bv 32 0x8049300)) nop)
+a "ja 2" 7700 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (bv 32 0x2)) nop)
+a "ja 6" 7704 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (bv 32 0x6)) nop)
+a "jae 2" 7300 0x0 (branch (! (var cf)) (jmp (bv 32 0x2)) nop)
+a "jae 6" 7304 0x0 (branch (! (var cf)) (jmp (bv 32 0x6)) nop)
+a "jb 0x8049300" 0f82fa920408 0x0 (branch (var cf) (jmp (bv 32 0x8049300)) nop)
+a "jb 2" 7200 0x0 (branch (var cf) (jmp (bv 32 0x2)) nop)
+a "jb 6" 7204 0x0 (branch (var cf) (jmp (bv 32 0x6)) nop)
+a "jbe 2" 7600 0x0 (branch (|| (var cf) (var zf)) (jmp (bv 32 0x2)) nop)
+a "jbe 6" 7604 0x0 (branch (|| (var cf) (var zf)) (jmp (bv 32 0x6)) nop)
+a "je 2" 7400 0x0 (branch (var zf) (jmp (bv 32 0x2)) nop)
+a "je 6" 7404 0x0 (branch (var zf) (jmp (bv 32 0x6)) nop)
+a "jg 0x8049300" 0f8ffa920408 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (bv 32 0x8049300)) nop)
+a "jg 2" 7f00 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (bv 32 0x2)) nop)
+a "jg 6" 7f04 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (bv 32 0x6)) nop)
+a "jge 0x8048010" 0f8d0a800408 0x0 (branch (! (^^ (var sf) (var of))) (jmp (bv 32 0x8048010)) nop)
+a "jge 0x8049300" 0f8dfa920408 0x0 (branch (! (^^ (var sf) (var of))) (jmp (bv 32 0x8049300)) nop)
+a "jge 2" 7d00 0x0 (branch (! (^^ (var sf) (var of))) (jmp (bv 32 0x2)) nop)
+a "jge 6" 7d04 0x0 (branch (! (^^ (var sf) (var of))) (jmp (bv 32 0x6)) nop)
+a "jl 0x8048010" 0f8c0a800408 0x0 (branch (^^ (var sf) (var of)) (jmp (bv 32 0x8048010)) nop)
+a "jl 0x8049300" 0f8cfa920408 0x0 (branch (^^ (var sf) (var of)) (jmp (bv 32 0x8049300)) nop)
+a "jl 2" 7c00 0x0 (branch (^^ (var sf) (var of)) (jmp (bv 32 0x2)) nop)
+a "jl 6" 7c04 0x0 (branch (^^ (var sf) (var of)) (jmp (bv 32 0x6)) nop)
+a "jle 0x8048010" 0f8e0a800408 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (bv 32 0x8048010)) nop)
+a "jle 0x8049300" 0f8efa920408 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (bv 32 0x8049300)) nop)
+a "jle 2" 7e00 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (bv 32 0x2)) nop)
+a "jle 6" 7e04 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (bv 32 0x6)) nop)
+a "jmp 0" ebfe 0x0 (jmp (cast 32 false (bv 32 0x0)))
+a "jmp 0x42" eb40 0x0 (jmp (cast 32 false (bv 32 0x42)))
+a "jmp -0x7e" eb80 0x0 (jmp (cast 32 false (bv 32 0xffffff82)))
+a "jmp -0x7f" e97cffffff 0x0 (jmp (cast 32 false (bv 32 0xffffff81)))
+a "jmp 0x8049200" e9fb910408 0x0 (jmp (cast 32 false (bv 32 0x8049200)))
+a "jmp 0x81" eb7f 0x0 (jmp (cast 32 false (bv 32 0x81)))
+a "jmp 0x82" e97d000000 0x0 (jmp (cast 32 false (bv 32 0x82)))
+a "jmp 2" eb00 0x0 (jmp (cast 32 false (bv 32 0x2)))
+a "jmp 3" eb01 0x0 (jmp (cast 32 false (bv 32 0x3)))
 a "jmp ecx" ffe1 0x0 (jmp (cast 32 false (var ecx)))
 a "jmp [ecx]" ff21 0x0 (jmp (cast 32 false (loadw 0 32 (+ (var ecx) (bv 32 0x0)))))
 a "jmp [ebx+43]" ff632b 0x0 (jmp (cast 32 false (loadw 0 32 (+ (var ebx) (bv 32 0x2b)))))
@@ -1314,60 +1314,60 @@ a "jmp [ecx+200]" ffa1c8000000 0x0 (jmp (cast 32 false (loadw 0 32 (+ (var ecx)
 a "jmp [edx-10]" ff62f6 0x0 (jmp (cast 32 false (loadw 0 32 (+ (var edx) (bv 32 0xfffffff6)))))
 a "jmp [eax-140]" ffa074ffffff 0x0 (jmp (cast 32 false (loadw 0 32 (+ (var eax) (bv 32 0xffffff74)))))
 a "bnd jmp 0x82" f2e97d000000
-a "jne 6" 7504 0x0 (branch (! (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-a "jno 2" 7100 0x0 (branch (! (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-a "jno 6" 7104 0x0 (branch (! (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-a "jnp 2" 7b00 0x0 (branch (! (var pf)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-a "jnp 6" 7b04 0x0 (branch (! (var pf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-a "jns 2" 7900 0x0 (branch (! (var sf)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-a "jns 6" 7904 0x0 (branch (! (var sf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-a "jnz 2" 7500 0x0 (branch (! (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-a "jo 2" 7000 0x0 (branch (var of) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-a "jo 6" 7004 0x0 (branch (var of) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-a "jp 2" 7a00 0x0 (branch (var pf) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-a "jp 6" 7a04 0x0 (branch (var pf) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-a "jpo 599" 0f8b51020000 0x0 (branch (! (var pf)) (jmp (+ (bv 32 0x0) (bv 32 0x257))) nop)
-a "js 2" 7800 0x0 (branch (var sf) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-a "js 6" 7804 0x0 (branch (var sf) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-a "jz 6" 7404 0x0 (branch (var zf) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-a "jz short 2" 7400 0x0 (branch (var zf) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-a "jnz short 6" 7504 0x0 (branch (! (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop)
-a "jz short 5" 7403 0x0 (branch (var zf) (jmp (+ (bv 32 0x0) (bv 32 0x5))) nop)
-a "jnz short -2" 75fc 0x0 (branch (! (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0xfffffffe))) nop)
-a "jz short -52" 74ca 0x0 (branch (var zf) (jmp (+ (bv 32 0x0) (bv 32 0xffffffcc))) nop)
-a "jnz short 23" 7515 0x0 (branch (! (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x17))) nop)
-a "jo short 32" 701e 0x0 (branch (var of) (jmp (+ (bv 32 0x0) (bv 32 0x20))) nop)
-a "jo short -62" 70c0 0x0 (branch (var of) (jmp (+ (bv 32 0x0) (bv 32 0xffffffc2))) nop)
-a "jno short 52" 7132 0x0 (branch (! (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x34))) nop)
-a "jno short -33" 71dd 0x0 (branch (! (var of)) (jmp (+ (bv 32 0x0) (bv 32 0xffffffdf))) nop)
-a "js short 43" 7829 0x0 (branch (var sf) (jmp (+ (bv 32 0x0) (bv 32 0x2b))) nop)
-a "js short -73" 78b5 0x0 (branch (var sf) (jmp (+ (bv 32 0x0) (bv 32 0xffffffb7))) nop)
-a "jns short -41" 79d5 0x0 (branch (! (var sf)) (jmp (+ (bv 32 0x0) (bv 32 0xffffffd7))) nop)
-a "jns short 63" 793d 0x0 (branch (! (var sf)) (jmp (+ (bv 32 0x0) (bv 32 0x3f))) nop)
-a "je short 24" 7416 0x0 (branch (var zf) (jmp (+ (bv 32 0x0) (bv 32 0x18))) nop)
-a "jne SHORT 84" 7552 0x0 (branch (! (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x54))) nop)
-a "jb short 23" 7215 0x0 (branch (var cf) (jmp (+ (bv 32 0x0) (bv 32 0x17))) nop)
-a "jnae short 65" 723f 0x0 (branch (var cf) (jmp (+ (bv 32 0x0) (bv 32 0x41))) nop)
-a "jc SHORT 37" 7223 0x0 (branch (var cf) (jmp (+ (bv 32 0x0) (bv 32 0x25))) nop)
-a "jnb short 97" 735f 0x0 (branch (! (var cf)) (jmp (+ (bv 32 0x0) (bv 32 0x61))) nop)
-a "jae short 10" 7308 0x0 (branch (! (var cf)) (jmp (+ (bv 32 0x0) (bv 32 0xa))) nop)
-a "jnc short 0" 73fe 0x0 (branch (! (var cf)) (jmp (+ (bv 32 0x0) (bv 32 0x0))) nop)
-a "jbe short -12" 76f2 0x0 (branch (|| (var cf) (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0xfffffff4))) nop)
-a "jna short 24" 7616 0x0 (branch (|| (var cf) (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x18))) nop)
-a "ja short 86" 7754 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (+ (bv 32 0x0) (bv 32 0x56))) nop)
-a "jnbe short 31" 771d 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (+ (bv 32 0x0) (bv 32 0x1f))) nop)
-a "jl short 16" 7c0e 0x0 (branch (^^ (var sf) (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x10))) nop)
-a "jnge short -40" 7cd6 0x0 (branch (^^ (var sf) (var of)) (jmp (+ (bv 32 0x0) (bv 32 0xffffffd8))) nop)
-a "jge short 52" 7d32 0x0 (branch (! (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x34))) nop)
-a "jnl short 76" 7d4a 0x0 (branch (! (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x4c))) nop)
-a "jle short 54" 7e34 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x36))) nop)
-a "jng short -80" 7eae 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0xffffffb0))) nop)
-a "jg short 56" 7f36 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (+ (bv 32 0x0) (bv 32 0x38))) nop)
-a "jnle short 2" 7f00 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop)
-a "jp short -7" 7af7 0x0 (branch (var pf) (jmp (+ (bv 32 0x0) (bv 32 0xfffffff9))) nop)
-a "jpe short 22" 7a14 0x0 (branch (var pf) (jmp (+ (bv 32 0x0) (bv 32 0x16))) nop)
-a "jnp short 64" 7b3e 0x0 (branch (! (var pf)) (jmp (+ (bv 32 0x0) (bv 32 0x40))) nop)
-a "jpo short 88" 7b56 0x0 (branch (! (var pf)) (jmp (+ (bv 32 0x0) (bv 32 0x58))) nop)
+a "jne 6" 7504 0x0 (branch (! (var zf)) (jmp (bv 32 0x6)) nop)
+a "jno 2" 7100 0x0 (branch (! (var of)) (jmp (bv 32 0x2)) nop)
+a "jno 6" 7104 0x0 (branch (! (var of)) (jmp (bv 32 0x6)) nop)
+a "jnp 2" 7b00 0x0 (branch (! (var pf)) (jmp (bv 32 0x2)) nop)
+a "jnp 6" 7b04 0x0 (branch (! (var pf)) (jmp (bv 32 0x6)) nop)
+a "jns 2" 7900 0x0 (branch (! (var sf)) (jmp (bv 32 0x2)) nop)
+a "jns 6" 7904 0x0 (branch (! (var sf)) (jmp (bv 32 0x6)) nop)
+a "jnz 2" 7500 0x0 (branch (! (var zf)) (jmp (bv 32 0x2)) nop)
+a "jo 2" 7000 0x0 (branch (var of) (jmp (bv 32 0x2)) nop)
+a "jo 6" 7004 0x0 (branch (var of) (jmp (bv 32 0x6)) nop)
+a "jp 2" 7a00 0x0 (branch (var pf) (jmp (bv 32 0x2)) nop)
+a "jp 6" 7a04 0x0 (branch (var pf) (jmp (bv 32 0x6)) nop)
+a "jpo 599" 0f8b51020000 0x0 (branch (! (var pf)) (jmp (bv 32 0x257)) nop)
+a "js 2" 7800 0x0 (branch (var sf) (jmp (bv 32 0x2)) nop)
+a "js 6" 7804 0x0 (branch (var sf) (jmp (bv 32 0x6)) nop)
+a "jz 6" 7404 0x0 (branch (var zf) (jmp (bv 32 0x6)) nop)
+a "jz short 2" 7400 0x0 (branch (var zf) (jmp (bv 32 0x2)) nop)
+a "jnz short 6" 7504 0x0 (branch (! (var zf)) (jmp (bv 32 0x6)) nop)
+a "jz short 5" 7403 0x0 (branch (var zf) (jmp (bv 32 0x5)) nop)
+a "jnz short -2" 75fc 0x0 (branch (! (var zf)) (jmp (bv 32 0xfffffffe)) nop)
+a "jz short -52" 74ca 0x0 (branch (var zf) (jmp (bv 32 0xffffffcc)) nop)
+a "jnz short 23" 7515 0x0 (branch (! (var zf)) (jmp (bv 32 0x17)) nop)
+a "jo short 32" 701e 0x0 (branch (var of) (jmp (bv 32 0x20)) nop)
+a "jo short -62" 70c0 0x0 (branch (var of) (jmp (bv 32 0xffffffc2)) nop)
+a "jno short 52" 7132 0x0 (branch (! (var of)) (jmp (bv 32 0x34)) nop)
+a "jno short -33" 71dd 0x0 (branch (! (var of)) (jmp (bv 32 0xffffffdf)) nop)
+a "js short 43" 7829 0x0 (branch (var sf) (jmp (bv 32 0x2b)) nop)
+a "js short -73" 78b5 0x0 (branch (var sf) (jmp (bv 32 0xffffffb7)) nop)
+a "jns short -41" 79d5 0x0 (branch (! (var sf)) (jmp (bv 32 0xffffffd7)) nop)
+a "jns short 63" 793d 0x0 (branch (! (var sf)) (jmp (bv 32 0x3f)) nop)
+a "je short 24" 7416 0x0 (branch (var zf) (jmp (bv 32 0x18)) nop)
+a "jne SHORT 84" 7552 0x0 (branch (! (var zf)) (jmp (bv 32 0x54)) nop)
+a "jb short 23" 7215 0x0 (branch (var cf) (jmp (bv 32 0x17)) nop)
+a "jnae short 65" 723f 0x0 (branch (var cf) (jmp (bv 32 0x41)) nop)
+a "jc SHORT 37" 7223 0x0 (branch (var cf) (jmp (bv 32 0x25)) nop)
+a "jnb short 97" 735f 0x0 (branch (! (var cf)) (jmp (bv 32 0x61)) nop)
+a "jae short 10" 7308 0x0 (branch (! (var cf)) (jmp (bv 32 0xa)) nop)
+a "jnc short 0" 73fe 0x0 (branch (! (var cf)) (jmp (bv 32 0x0)) nop)
+a "jbe short -12" 76f2 0x0 (branch (|| (var cf) (var zf)) (jmp (bv 32 0xfffffff4)) nop)
+a "jna short 24" 7616 0x0 (branch (|| (var cf) (var zf)) (jmp (bv 32 0x18)) nop)
+a "ja short 86" 7754 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (bv 32 0x56)) nop)
+a "jnbe short 31" 771d 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (bv 32 0x1f)) nop)
+a "jl short 16" 7c0e 0x0 (branch (^^ (var sf) (var of)) (jmp (bv 32 0x10)) nop)
+a "jnge short -40" 7cd6 0x0 (branch (^^ (var sf) (var of)) (jmp (bv 32 0xffffffd8)) nop)
+a "jge short 52" 7d32 0x0 (branch (! (^^ (var sf) (var of))) (jmp (bv 32 0x34)) nop)
+a "jnl short 76" 7d4a 0x0 (branch (! (^^ (var sf) (var of))) (jmp (bv 32 0x4c)) nop)
+a "jle short 54" 7e34 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (bv 32 0x36)) nop)
+a "jng short -80" 7eae 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (bv 32 0xffffffb0)) nop)
+a "jg short 56" 7f36 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (bv 32 0x38)) nop)
+a "jnle short 2" 7f00 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (bv 32 0x2)) nop)
+a "jp short -7" 7af7 0x0 (branch (var pf) (jmp (bv 32 0xfffffff9)) nop)
+a "jpe short 22" 7a14 0x0 (branch (var pf) (jmp (bv 32 0x16)) nop)
+a "jnp short 64" 7b3e 0x0 (branch (! (var pf)) (jmp (bv 32 0x40)) nop)
+a "jpo short 88" 7b56 0x0 (branch (! (var pf)) (jmp (bv 32 0x58)) nop)
 a "lahf" 9f
 aB "lar eax, word [eax]" 0f02
 aB "lcall 0, 0" 9a
@@ -1961,10 +1961,10 @@ a "sfence" 0faef8
 a "sgdt [eax]" 0f0100
 aB "shld dword [eax], eax, 0" 0fa40000
 aB "shld dword [eax], eax, cl" 0fa500
-ad "sar edx, 5" c1fa05 0x0 (seq (set _cnt (bv 8 0x5)) (set _cnt_mask (bv 8 0x3f)) (set _masked (& (var _cnt) (var _cnt_mask))) (set _tmp_cnt (var _masked)) (set _dest (var edx)) (set _tmp_dest (var _dest)) (repeat (! (is_zero (var _tmp_cnt))) (seq (set cf (lsb (var _dest))) (set _dest (>> (var _dest) (bv 8 0x1) (msb (var _dest)))) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (== (var _masked) (bv 8 0x1)) (set of false) nop))
-ad "sal edx, 5" c1f205 0x0 (seq (set _cnt (bv 8 0x5)) (set _cnt_mask (bv 8 0x3f)) (set _masked (& (var _cnt) (var _cnt_mask))) (set _tmp_cnt (var _masked)) (set _dest (var edx)) (set _tmp_dest (var _dest)) (repeat (! (is_zero (var _tmp_cnt))) (seq (set cf (msb (var _dest))) (set _dest (<< (var _dest) (bv 8 0x1) false)) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (== (var _masked) (bv 8 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop))
-ad "shl edx, 5" c1e205 0x0 (seq (set _cnt (bv 8 0x5)) (set _cnt_mask (bv 8 0x3f)) (set _masked (& (var _cnt) (var _cnt_mask))) (set _tmp_cnt (var _masked)) (set _dest (var edx)) (set _tmp_dest (var _dest)) (repeat (! (is_zero (var _tmp_cnt))) (seq (set cf (msb (var _dest))) (set _dest (<< (var _dest) (bv 8 0x1) false)) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (== (var _masked) (bv 8 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop))
-ad "shr edx, 5" c1ea05 0x0 (seq (set _cnt (bv 8 0x5)) (set _cnt_mask (bv 8 0x3f)) (set _masked (& (var _cnt) (var _cnt_mask))) (set _tmp_cnt (var _masked)) (set _dest (var edx)) (set _tmp_dest (var _dest)) (repeat (! (is_zero (var _tmp_cnt))) (seq (set cf (lsb (var _dest))) (set _dest (>> (var _dest) (bv 8 0x1) false)) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (== (var _masked) (bv 8 0x1)) (set of (msb (var _tmp_dest))) nop))
+ad "sar edx, 5" c1fa05 0x0 (seq (set _cnt (bv 8 0x5)) (set _cnt_mask (bv 8 0x1f)) (set _masked (& (var _cnt) (var _cnt_mask))) (set _tmp_cnt (var _masked)) (set _dest (var edx)) (set _tmp_dest (var _dest)) (repeat (! (is_zero (var _tmp_cnt))) (seq (set cf (lsb (var _dest))) (set _dest (>> (var _dest) (bv 8 0x1) (msb (var _dest)))) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (== (var _masked) (bv 8 0x1)) (set of false) nop) (set edx (var _dest)) (set _result (var _dest)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+ad "sal edx, 5" c1f205 0x0 (seq (set _cnt (bv 8 0x5)) (set _cnt_mask (bv 8 0x1f)) (set _masked (& (var _cnt) (var _cnt_mask))) (set _tmp_cnt (var _masked)) (set _dest (var edx)) (set _tmp_dest (var _dest)) (repeat (! (is_zero (var _tmp_cnt))) (seq (set cf (msb (var _dest))) (set _dest (<< (var _dest) (bv 8 0x1) false)) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (== (var _masked) (bv 8 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop) (set edx (var _dest)) (set _result (var _dest)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+ad "shl edx, 5" c1e205 0x0 (seq (set _cnt (bv 8 0x5)) (set _cnt_mask (bv 8 0x1f)) (set _masked (& (var _cnt) (var _cnt_mask))) (set _tmp_cnt (var _masked)) (set _dest (var edx)) (set _tmp_dest (var _dest)) (repeat (! (is_zero (var _tmp_cnt))) (seq (set cf (msb (var _dest))) (set _dest (<< (var _dest) (bv 8 0x1) false)) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (== (var _masked) (bv 8 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop) (set edx (var _dest)) (set _result (var _dest)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+ad "shr edx, 5" c1ea05 0x0 (seq (set _cnt (bv 8 0x5)) (set _cnt_mask (bv 8 0x1f)) (set _masked (& (var _cnt) (var _cnt_mask))) (set _tmp_cnt (var _masked)) (set _dest (var edx)) (set _tmp_dest (var _dest)) (repeat (! (is_zero (var _tmp_cnt))) (seq (set cf (lsb (var _dest))) (set _dest (>> (var _dest) (bv 8 0x1) false)) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (== (var _masked) (bv 8 0x1)) (set of (msb (var _tmp_dest))) nop) (set edx (var _dest)) (set _result (var _dest)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
 aB "shrd dword [eax], eax, 0" 0fac0000
 aB "shrd dword [eax], eax, cl" 0fad00
 aB "shufpd xmm0, xmmword [eax], 0x0" 660fc60000
@@ -2018,14 +2018,14 @@ a "syscall" 0f05
 a "sysenter" 0f34
 a "sysexit" 0f35
 a "sysret" 0f07
-a "test al, 0" f6c000 0x0 (seq (set _res (& (cast 8 false (var eax)) (bv 8 0x0))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _res)))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-a "test byte [eax], 0" f60000 0x0 (seq (set _res (& (loadw 0 8 (+ (var eax) (bv 32 0x0))) (bv 8 0x0))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-a "test byte [eax], al" 8400 0x0 (seq (set _res (& (loadw 0 8 (+ (var eax) (bv 32 0x0))) (cast 8 false (var eax)))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-a "test dword [eax], 0" f70000000000 0x0 (seq (set _res (& (loadw 0 32 (+ (var eax) (bv 32 0x0))) (bv 32 0x0))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-a "test dword [eax], eax" 8500 0x0 (seq (set _res (& (loadw 0 32 (+ (var eax) (bv 32 0x0))) (var eax))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-a "test eax, 0" f7c000000000 0x0 (seq (set _res (& (var eax) (bv 32 0x0))) (set eax (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-a "test eax, ebx" 85d8 0x0 (seq (set _res (& (var eax) (var ebx))) (set eax (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-a "test edx, esi" 85f2 0x0 (seq (set _res (& (var edx) (var esi))) (set edx (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+a "test al, 0" f6c000 0x0 (seq (set _res (& (cast 8 false (var eax)) (bv 8 0x0))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+a "test byte [eax], 0" f60000 0x0 (seq (set _res (& (loadw 0 8 (+ (var eax) (bv 32 0x0))) (bv 8 0x0))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+a "test byte [eax], al" 8400 0x0 (seq (set _res (& (loadw 0 8 (+ (var eax) (bv 32 0x0))) (cast 8 false (var eax)))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+a "test dword [eax], 0" f70000000000 0x0 (seq (set _res (& (loadw 0 32 (+ (var eax) (bv 32 0x0))) (bv 32 0x0))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+a "test dword [eax], eax" 8500 0x0 (seq (set _res (& (loadw 0 32 (+ (var eax) (bv 32 0x0))) (var eax))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+a "test eax, 0" f7c000000000 0x0 (seq (set _res (& (var eax) (bv 32 0x0))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+a "test eax, ebx" 85d8 0x0 (seq (set _res (& (var eax) (var ebx))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+a "test edx, esi" 85f2 0x0 (seq (set _res (& (var edx) (var esi))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
 aB "ucomisd xmm0, qword [eax]" 660f2e00
 aB "ucomiss xmm0, dword [eax]" 0f2e00
 a "ud2" 0f0b
@@ -2219,7 +2219,7 @@ a "int 0x80" cd80 0x0 (seq (goto int) empty)
 a "mov eax, 33" b821000000 0x0 (set eax (bv 32 0x21))
 aB "mov rax, 33" 48c7c021000000 0x0 (set eax (bv 32 0x21))
 a "mov [ebp+4],0" c7450400000000 0x0 (storew 0 (+ (var ebp) (bv 32 0x4)) (bv 32 0x0))
-a "jmp 0x1b" eb05 0x14 (jmp (+ (bv 32 0x14) (bv 32 0x1b)))
+a "jmp 0x1b" eb05 0x14 (jmp (cast 32 false (bv 32 0x1b)))
 ad "sete al" 0f94c0
 a "mov byte ptr [bp+di],0x0" 67c60300 0x0 (storew 0 (+ (+ (cast 32 false (cast 16 false (var ebp))) (* (cast 32 false (cast 16 false (var edi))) (bv 32 0x1))) (bv 32 0x0)) (bv 8 0x0))
 a "mov byte ptr [bp+di-0x1],0x20" 67c643ff20 0x0 (storew 0 (+ (+ (cast 32 false (cast 16 false (var ebp))) (* (cast 32 false (cast 16 false (var edi))) (bv 32 0x1))) (bv 32 0xffffffff)) (bv 8 0x20))
diff --git a/test/db/asm/x86_64 b/test/db/asm/x86_64
index 7d9c1ff39d..41567d8873 100644
--- a/test/db/asm/x86_64
+++ b/test/db/asm/x86_64
@@ -1,17 +1,17 @@
-a "lea rax, [0x1000]" 488d05f90f0000 0x0 (set rax (+ (bv 64 0x0) (bv 64 0xff9)))
-d "lea rax, [rip + 0xff9]" 488d05f90f0000 0x0 (set rax (+ (bv 64 0x0) (bv 64 0xff9)))
+a "lea rax, [0x1000]" 488d05f90f0000 0x0 (set rax (+ (bv 64 0x7) (bv 64 0xff9)))
+d "lea rax, [rip + 0xff9]" 488d05f90f0000 0x0 (set rax (+ (bv 64 0x7) (bv 64 0xff9)))
 ad "leave" c9 0x0 (seq (set rsp (var rbp)) (set rsp (+ (var rsp) (bv 64 0x8))) (set rbp (loadw 0 64 (+ (var rsp) (bv 64 0x0)))))
 d "leave" 66c9 0x0 (seq (set rsp (var rbp)) (set rsp (+ (var rsp) (bv 64 0x4))) (set rbp (| (& (var rbp) (~ (bv 64 0xffffffff))) (cast 64 false (loadw 0 32 (+ (var rsp) (bv 64 0x0)))))))
 ad "nop" 90 0x0 nop
 ad "ret" c3 0x0 (seq (set rsp (+ (var rsp) (bv 64 0x8))) (set rsp (loadw 0 64 (+ (var rsp) (bv 64 0x0)))))
-a "add r13, r15" 4d01fd 0x0 (seq (set op1 (var r13)) (set op2 (var r15)) (set sum (+ (var op1) (var op2))) (set r13 (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))))
-a "add r15, rbx" 4901df 0x0 (seq (set op1 (var r15)) (set op2 (var rbx)) (set sum (+ (var op1) (var op2))) (set r15 (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))))
+a "add r13, r15" 4d01fd 0x0 (seq (set op1 (var r13)) (set op2 (var r15)) (set sum (+ (var op1) (var op2))) (set r13 (cast 64 false (var sum))) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))))
+a "add r15, rbx" 4901df 0x0 (seq (set op1 (var r15)) (set op2 (var rbx)) (set sum (+ (var op1) (var op2))) (set r15 (cast 64 false (var sum))) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))))
 a "add rax, 44" 4883c02c 0x0 (seq (set op1 (var rax)) (set op2 (bv 64 0x2c)) (set sum (+ (var op1) (var op2))) (set rax (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))))
 a "add rax, r8" 4c01c0 0x0 (seq (set op1 (var rax)) (set op2 (var r8)) (set sum (+ (var op1) (var op2))) (set rax (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))))
-a "add r10, r9" 4d01ca 0x0 (seq (set op1 (var r10)) (set op2 (var r9)) (set sum (+ (var op1) (var op2))) (set r10 (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))))
+a "add r10, r9" 4d01ca 0x0 (seq (set op1 (var r10)) (set op2 (var r9)) (set sum (+ (var op1) (var op2))) (set r10 (cast 64 false (var sum))) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))))
 a "add rax, rcx" 4801c8 0x0 (seq (set op1 (var rax)) (set op2 (var rcx)) (set sum (+ (var op1) (var op2))) (set rax (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))))
 aB "and dword [ebp + 128], eax" 48218580000000
-a "call rbx" ffd3 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0))))
+a "call rbx" ffd3 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (bv 64 0x2))) (jmp (var rbx)))
 a "cdqe" 4898 0x0 empty
 d "cmp qword [rax], 0x21" 48833821 0x0 (seq (set op1 (loadw 0 64 (+ (var rax) (bv 64 0x0)))) (set op2 (bv 64 0x21)) (set sub (- (var op1) (var op2))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
 a "cmp rax, 33" 4883f821 0x0 (seq (set op1 (var rax)) (set op2 (bv 64 0x21)) (set sub (- (var op1) (var op2))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
@@ -28,7 +28,7 @@ a "lodsd" ad 0x0 (seq (set rax (| (& (var rax) (~ (bv 64 0xffffffff))) (cast 64
 a "lodsw" 66ad 0x0 (seq (set rax (| (& (var rax) (~ (bv 64 0xffff))) (cast 64 false (loadw 0 16 (var rsi))))) (branch (var df) (set rsi (- (var rsi) (bv 64 0x2))) (set rsi (+ (var rsi) (bv 64 0x2)))))
 d "lodsd eax, dword [esi]" 67ad 0x0 (seq (set rax (| (& (var rax) (~ (bv 64 0xffffffff))) (cast 64 false (loadw 0 32 (cast 64 false (cast 32 false (var rsi))))))) (branch (var df) (set rsi (| (& (var rsi) (~ (bv 64 0xffffffff))) (cast 64 false (- (cast 32 false (var rsi)) (bv 32 0x4))))) (set rsi (| (& (var rsi) (~ (bv 64 0xffffffff))) (cast 64 false (+ (cast 32 false (var rsi)) (bv 32 0x4)))))))
 d "lodsq rax, qword [rsi]" 48ad 0x0 (seq (set rax (loadw 0 64 (var rsi))) (branch (var df) (set rsi (- (var rsi) (bv 64 0x8))) (set rsi (+ (var rsi) (bv 64 0x8)))))
-d "loop 0" 67e2fd 0x0 (seq (set rcx (| (& (var rcx) (~ (bv 64 0xffffffff))) (cast 64 false (- (cast 32 false (var rcx)) (bv 32 0x1))))) (branch (! (is_zero (cast 32 false (var rcx)))) (jmp (bv 64 0x0)) nop))
+d "loop 0" 67e2fd 0x0 (seq (set rcx (| (& (var rcx) (~ (bv 64 0xffffffff))) (cast 64 false (- (cast 32 false (var rcx)) (bv 32 0x1))))) (branch (! (is_zero (cast 32 false (var rcx)))) (jmp (bv 64 0x3)) nop))
 a "movsb" a4 0x0 (seq (storew 0 (var rdi) (loadw 0 8 (var rsi))) (branch (var df) (seq (set rsi (- (var rsi) (bv 64 0x1))) (set rdi (- (var rdi) (bv 64 0x1)))) (seq (set rsi (+ (var rsi) (bv 64 0x1))) (set rdi (+ (var rdi) (bv 64 0x1))))))
 a "movsd" a5 0x0 (seq (storew 0 (var rdi) (loadw 0 32 (var rsi))) (branch (var df) (seq (set rsi (- (var rsi) (bv 64 0x4))) (set rdi (- (var rdi) (bv 64 0x4)))) (seq (set rsi (+ (var rsi) (bv 64 0x4))) (set rdi (+ (var rdi) (bv 64 0x4))))))
 a "movsw" 66a5 0x0 (seq (storew 0 (var rdi) (loadw 0 16 (var rsi))) (branch (var df) (seq (set rsi (- (var rsi) (bv 64 0x2))) (set rdi (- (var rdi) (bv 64 0x2)))) (seq (set rsi (+ (var rsi) (bv 64 0x2))) (set rdi (+ (var rdi) (bv 64 0x2))))))
@@ -49,8 +49,8 @@ ad "div rax" 48f7f0 0x0 (seq (set _src (cast 128 false (var rax))) (branch (is_z
 ad "idiv rax" 48f7f8 0x0 (seq (set _src (cast 128 false (var rax))) (branch (is_zero (var _src)) nop (seq (set _rdxrax (| (<< (cast 128 false (cast 32 false (var rdx))) (bv 8 0x40) false) (cast 128 false (cast 32 false (var rax))))) (set _temp (cast 64 false (sdiv (var _rdxrax) (var _src)))) (branch (|| (! (sle (var _temp) (bv 64 0x7fffffffffffffff))) (&& (sle (var _temp) (bv 64 0x8000000000000000)) (! (== (var _temp) (bv 64 0x8000000000000000))))) nop (seq (set rax (| (& (var rax) (~ (bv 64 0xffff))) (cast 64 false (var _temp)))) (set rdx (| (& (var rdx) (~ (bv 64 0xffff))) (cast 64 false (smod (var _rdxrax) (var _src))))))))))
 ad "imul rax" 48f7e8 0x0 (seq (set _tmp_xp (* (cast 128 (msb (var rax)) (var rax)) (cast 128 (msb (var rax)) (var rax)))) (set rax (cast 64 false (var _tmp_xp))) (set rdx (cast 64 false (>> (var _tmp_xp) (bv 8 0x40) false))) (branch (== (cast 128 (msb (cast 64 false (var _tmp_xp))) (cast 64 false (var _tmp_xp))) (var _tmp_xp)) (seq (set cf false) (set of false)) (seq (set cf true) (set of true))))
 a "inc rdx" 48ffc2 0x0 (seq (set _op (var rdx)) (set _result (+ (var _op) (bv 64 0x1))) (set rdx (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
-d "jrcxz 0x39" e303 0x34 (branch (is_zero (var rcx)) (jmp (+ (bv 64 0x34) (bv 64 0x39))) nop)
-d "jecxz 0x4a" 67e303 0x44 (branch (is_zero (cast 32 false (var rcx))) (jmp (+ (bv 64 0x44) (bv 64 0x4a))) nop)
+d "jrcxz 0x39" e303 0x34 (branch (is_zero (var rcx)) (jmp (bv 64 0x39)) nop)
+d "jecxz 0x4a" 67e303 0x44 (branch (is_zero (cast 32 false (var rcx))) (jmp (bv 64 0x4a)) nop)
 a "jmp rbx" ffe3 0x0 (jmp (cast 64 false (var rbx)))
 a "lea rax, [rax+0]" 488d00 0x0 (set rax (+ (var rax) (bv 64 0x0)))
 a "lea rax, [rax+1]" 488d4001 0x0 (set rax (+ (var rax) (bv 64 0x1)))
@@ -62,12 +62,12 @@ d "lea rax, [eax]" 67488d00 0x0 (set rax (+ (cast 64 false (cast 32 false (var r
 aB "lea rax,[rel -10]" 488d06f6ffffff
 aB "lea rax,[rel 0]" 488d0500000000
 aB "lea rax,[rel 10]" 488d050a000000
-a "lea rax,[rip+0]" 488d0500000000 0x0 (set rax (+ (bv 64 0x0) (bv 64 0x0)))
-a "lea rax,[rip+10]" 488d050a000000 0x0 (set rax (+ (bv 64 0x0) (bv 64 0xa)))
-a "lea rax,[rip-0]" 488d0500000000 0x0 (set rax (+ (bv 64 0x0) (bv 64 0x0)))
-a "lea rax,[rip-10]" 488d05f6ffffff 0x0 (set rax (+ (bv 64 0x0) (bv 64 0xfffffffffffffff6)))
-a "lea rax,[rip]" 488d0500000000 0x0 (set rax (+ (bv 64 0x0) (bv 64 0x0)))
-a "lea rdi,[rip+0x1011]" 488d3d11100000 0x0 (set rdi (+ (bv 64 0x0) (bv 64 0x1011)))
+a "lea rax,[rip+0]" 488d0500000000 0x0 (set rax (+ (bv 64 0x7) (bv 64 0x0)))
+a "lea rax,[rip+10]" 488d050a000000 0x0 (set rax (+ (bv 64 0x7) (bv 64 0xa)))
+a "lea rax,[rip-0]" 488d0500000000 0x0 (set rax (+ (bv 64 0x7) (bv 64 0x0)))
+a "lea rax,[rip-10]" 488d05f6ffffff 0x0 (set rax (+ (bv 64 0x7) (bv 64 0xfffffffffffffff6)))
+a "lea rax,[rip]" 488d0500000000 0x0 (set rax (+ (bv 64 0x7) (bv 64 0x0)))
+a "lea rdi,[rip+0x1011]" 488d3d11100000 0x0 (set rdi (+ (bv 64 0x7) (bv 64 0x1011)))
 aB "lea rax, [0x803]" 488d042503080000
 aB "lea rax, 0x803" 488d042503080000
 a "mov [rsi], rbx" 48891e 0x0 (storew 0 (+ (var rsi) (bv 64 0x0)) (var rbx))
@@ -102,13 +102,13 @@ a "mov rax, -0x80000000" 48c7c000000080 0x0 (set rax (bv 64 0xffffffff80000000))
 ad "mov rax, 0xffffffff80000000" 48c7c000000080 0x0 (set rax (bv 64 0xffffffff80000000))
 a "mov rax, -0x80000001" 48b8ffffff7fffffffff 0x0 empty
 ad "movabs rax, 0xffffffff7fffffff" 48b8ffffff7fffffffff 0x0 empty
-ad "mov r9, 0x7fffffff" 49c7c1ffffff7f 0x0 (set r9 (bv 64 0x7fffffff))
+ad "mov r9, 0x7fffffff" 49c7c1ffffff7f 0x0 (set r9 (cast 64 false (bv 64 0x7fffffff)))
 a "mov r10, 0x80000000" 49ba0000008000000000 0x0 empty
 ad "movabs r10, 0x80000000" 49ba0000008000000000 0x0 empty
 a "mov r11, 0x100000000" 49bb0000000001000000 0x0 empty
 ad "movabs r11, 0x100000000" 49bb0000000001000000 0x0 empty
-a "mov r14, -0x80000000" 49c7c600000080 0x0 (set r14 (bv 64 0xffffffff80000000))
-ad "mov r14, 0xffffffff80000000" 49c7c600000080 0x0 (set r14 (bv 64 0xffffffff80000000))
+a "mov r14, -0x80000000" 49c7c600000080 0x0 (set r14 (cast 64 false (bv 64 0xffffffff80000000)))
+ad "mov r14, 0xffffffff80000000" 49c7c600000080 0x0 (set r14 (cast 64 false (bv 64 0xffffffff80000000)))
 a "mov r15, -0x80000001" 49bfffffff7fffffffff 0x0 empty
 ad "movabs r15, 0xffffffff7fffffff" 49bfffffff7fffffffff 0x0 empty
 a "mov rax, [rax+0]" 488b00 0x0 (set rax (loadw 0 64 (+ (var rax) (bv 64 0x0))))
@@ -119,11 +119,11 @@ a "mov rax, [rax]" 488b00 0x0 (set rax (loadw 0 64 (+ (var rax) (bv 64 0x0))))
 aB "mov rax,[rel -10]" 488b05f6ffffff
 aB "mov rax,[rel 0]" 488b0500000000
 aB "mov rax,[rel 10]" 488b050a000000
-a "mov rax,[rip+0]" 488b0500000000 0x0 (set rax (loadw 0 64 (+ (bv 64 0x0) (bv 64 0x0))))
-a "mov rax,[rip+10]" 488b050a000000 0x0 (set rax (loadw 0 64 (+ (bv 64 0x0) (bv 64 0xa))))
-a "mov rax,[rip-0]" 488b0500000000 0x0 (set rax (loadw 0 64 (+ (bv 64 0x0) (bv 64 0x0))))
-a "mov rax,[rip-10]" 488b05f6ffffff 0x0 (set rax (loadw 0 64 (+ (bv 64 0x0) (bv 64 0xfffffffffffffff6))))
-a "mov rax,[rip]" 488b0500000000 0x0 (set rax (loadw 0 64 (+ (bv 64 0x0) (bv 64 0x0))))
+a "mov rax,[rip+0]" 488b0500000000 0x0 (set rax (loadw 0 64 (+ (bv 64 0x7) (bv 64 0x0))))
+a "mov rax,[rip+10]" 488b050a000000 0x0 (set rax (loadw 0 64 (+ (bv 64 0x7) (bv 64 0xa))))
+a "mov rax,[rip-0]" 488b0500000000 0x0 (set rax (loadw 0 64 (+ (bv 64 0x7) (bv 64 0x0))))
+a "mov rax,[rip-10]" 488b05f6ffffff 0x0 (set rax (loadw 0 64 (+ (bv 64 0x7) (bv 64 0xfffffffffffffff6))))
+a "mov rax,[rip]" 488b0500000000 0x0 (set rax (loadw 0 64 (+ (bv 64 0x7) (bv 64 0x0))))
 a "mov rbx, 3" 48c7c303000000 0x0 (set rbx (bv 64 0x3))
 a "mov edx, [rbp-4]" 8b55fc 0x0 (set rdx (| (& (var rdx) (~ (bv 64 0xffffffff))) (cast 64 false (loadw 0 32 (+ (var rbp) (bv 64 0xfffffffffffffffc))))))
 a "mov rbx, rax" 4889c3 0x0 (set rbx (var rax))
@@ -131,8 +131,8 @@ a "mov rcx, -0x1122334455667788" 48b9788899aabbccddee 0x0 empty
 aB "mov rcx, -0x112233445566778899" 00
 a "mov rsi, rbx" 4889de 0x0 (set rsi (var rbx))
 a "mov rcx, r9" 4c89c9 0x0 (set rcx (var r9))
-a "mov r10, rax" 4989c2 0x0 (set r10 (var rax))
-a "mov r12, r9" 4d89cc 0x0 (set r12 (var r9))
+a "mov r10, rax" 4989c2 0x0 (set r10 (cast 64 false (var rax)))
+a "mov r12, r9" 4d89cc 0x0 (set r12 (cast 64 false (var r9)))
 a "mov rcx, rbp" 4889e9 0x0 (set rcx (var rbp))
 a "mov al, [0xbeef]" a0efbe000000000000 0x0 empty
 a "mov ax, [0xbeef]" 66a1efbe000000000000 0x0 empty
@@ -143,35 +143,35 @@ a "mov rax, [rax + 0xbeef]" 488b80efbe0000 0x0 (set rax (loadw 0 64 (+ (var rax)
 a "mov rax, [rbx + 0xbeef]" 488b83efbe0000 0x0 (set rax (loadw 0 64 (+ (var rbx) (bv 64 0xbeef))))
 a "mov rcx, [rbx + 0xbeef]" 488b8befbe0000 0x0 (set rcx (loadw 0 64 (+ (var rbx) (bv 64 0xbeef))))
 a "mov rbx, [rbp + 0xbeef]" 488b9defbe0000 0x0 (set rbx (loadw 0 64 (+ (var rbp) (bv 64 0xbeef))))
-a "mov rax, [rip + 0xbeef]" 488b05efbe0000 0x0 (set rax (loadw 0 64 (+ (bv 64 0x0) (bv 64 0xbeef))))
+a "mov rax, [rip + 0xbeef]" 488b05efbe0000 0x0 (set rax (loadw 0 64 (+ (bv 64 0x7) (bv 64 0xbeef))))
 a "mov qword [rax], 0x0" 48c70000000000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 64 0x0))
 aB "mov sil, 0" 40b600
 aB "mov dil, -5" 40b7fb
 aB "mov spl, bpl" 4088ec
 a "pop rax" 58 0x0 (seq (set rax (loadw 0 64 (+ (var rsp) (bv 64 0x0)))) (set rsp (+ (var rsp) (bv 64 0x8))))
-ad "pop r8" 4158 0x0 (seq (set r8 (loadw 0 64 (+ (var rsp) (bv 64 0x0)))) (set rsp (+ (var rsp) (bv 64 0x8))))
-ad "pop r15" 415f 0x0 (seq (set r15 (loadw 0 64 (+ (var rsp) (bv 64 0x0)))) (set rsp (+ (var rsp) (bv 64 0x8))))
+ad "pop r8" 4158 0x0 (seq (set r8 (cast 64 false (loadw 0 64 (+ (var rsp) (bv 64 0x0))))) (set rsp (+ (var rsp) (bv 64 0x8))))
+ad "pop r15" 415f 0x0 (seq (set r15 (cast 64 false (loadw 0 64 (+ (var rsp) (bv 64 0x0))))) (set rsp (+ (var rsp) (bv 64 0x8))))
 d "popfq" 9d 0x0 (seq (set _flags (loadw 0 64 (+ (var rsp) (bv 64 0x0)))) (set cf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set pf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set af (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set zf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set sf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set tf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set if (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set df (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set of (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x3) false)) (set nt (lsb (var _flags))) (set rsp (+ (var rsp) (bv 64 0x8))))
 d "pushfq" 9c 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (ite false (bv 64 0x1) (bv 64 0x0)) (bv 64 0x1) false) (ite (var nt) (bv 64 0x1) (bv 64 0x0))) (bv 64 0x2) false) (bv 64 0x3)) (bv 64 0x1) false) (ite (var of) (bv 64 0x1) (bv 64 0x0))) (bv 64 0x1) false) (ite (var df) (bv 64 0x1) (bv 64 0x0))) (bv 64 0x1) false) (ite (var if) (bv 64 0x1) (bv 64 0x0))) (bv 64 0x1) false) (ite (var tf) (bv 64 0x1) (bv 64 0x0))) (bv 64 0x1) false) (ite (var zf) (bv 64 0x1) (bv 64 0x0))) (bv 64 0x1) false) (ite (var zf) (bv 64 0x1) (bv 64 0x0))) (bv 64 0x2) false) (ite (var af) (bv 64 0x1) (bv 64 0x0))) (bv 64 0x2) false) (ite (var pf) (bv 64 0x1) (bv 64 0x0))) (bv 64 0x1) false) (bv 64 0x1)) (bv 64 0x1) false) (ite (var cf) (bv 64 0x1) (bv 64 0x0))))))
 aB "prefetcht1 [eax]" 670f1810
 aB "prefetcht1 [rax]" 0f1810
 aB "prefetcht1 byte [eax]" 670f1810
 aB "prefetcht1 byte [rax]" 0f1810
-a "shl rdx, 5" 48c1e205 0x0 (seq (set _cnt (bv 8 0x5)) (set _cnt_mask (bv 8 0x3f)) (set _masked (& (var _cnt) (var _cnt_mask))) (set _tmp_cnt (var _masked)) (set _dest (var rdx)) (set _tmp_dest (var _dest)) (repeat (! (is_zero (var _tmp_cnt))) (seq (set cf (msb (var _dest))) (set _dest (<< (var _dest) (bv 8 0x1) false)) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (== (var _masked) (bv 8 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop))
+a "shl rdx, 5" 48c1e205 0x0 (seq (set _cnt (bv 8 0x5)) (set _cnt_mask (bv 8 0x3f)) (set _masked (& (var _cnt) (var _cnt_mask))) (set _tmp_cnt (var _masked)) (set _dest (var rdx)) (set _tmp_dest (var _dest)) (repeat (! (is_zero (var _tmp_cnt))) (seq (set cf (msb (var _dest))) (set _dest (<< (var _dest) (bv 8 0x1) false)) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (== (var _masked) (bv 8 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop) (set rdx (var _dest)) (set _result (var _dest)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
 a "sub rax, 44" 4883e82c 0x0 (seq (set op1 (var rax)) (set op2 (bv 64 0x2c)) (set sub (- (var op1) (var op2))) (set rax (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
 a "sub rax, rbx" 4829d8 0x0 (seq (set op1 (var rax)) (set op2 (var rbx)) (set sub (- (var op1) (var op2))) (set rax (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "sub r9, rbx" 4929d9 0x0 (seq (set op1 (var r9)) (set op2 (var rbx)) (set sub (- (var op1) (var op2))) (set r9 (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
+a "sub r9, rbx" 4929d9 0x0 (seq (set op1 (var r9)) (set op2 (var rbx)) (set sub (- (var op1) (var op2))) (set r9 (cast 64 false (var sub))) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
 a "sub rcx, r10" 4c29d1 0x0 (seq (set op1 (var rcx)) (set op2 (var r10)) (set sub (- (var op1) (var op2))) (set rcx (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "sub r12, r11" 4d29dc 0x0 (seq (set op1 (var r12)) (set op2 (var r11)) (set sub (- (var op1) (var op2))) (set r12 (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "test ebx, 0x12345678" f7c378563412 0x0 (seq (set _res (& (cast 32 false (var rbx)) (bv 32 0x12345678))) (set rbx (| (& (var rbx) (~ (bv 64 0xffffffff))) (cast 64 false (var _res)))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-a "test rbx, 0x12345678" 48f7c378563412 0x0 (seq (set _res (& (var rbx) (bv 64 0x12345678))) (set rbx (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-a "test dword [eax], 0x12345678" 67f70078563412 0x0 (seq (set _res (& (loadw 0 32 (+ (cast 64 false (cast 32 false (var rax))) (bv 64 0x0))) (bv 32 0x12345678))) (storew 0 (+ (cast 64 false (cast 32 false (var rax))) (bv 64 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-a "test dword [rax], 0x12345678" f70078563412 0x0 (seq (set _res (& (loadw 0 32 (+ (var rax) (bv 64 0x0))) (bv 32 0x12345678))) (storew 0 (+ (var rax) (bv 64 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-a "test qword [rcx], 0x12345678" 48f70178563412 0x0 (seq (set _res (& (loadw 0 64 (+ (var rcx) (bv 64 0x0))) (bv 64 0x12345678))) (storew 0 (+ (var rcx) (bv 64 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-a "test rax, rbx" 4885d8 0x0 (seq (set _res (& (var rax) (var rbx))) (set rax (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-a "test rcx, rcx" 4885c9 0x0 (seq (set _res (& (var rcx) (var rcx))) (set rcx (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-a "test rdx, rsi" 4885f2 0x0 (seq (set _res (& (var rdx) (var rsi))) (set rdx (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
-a "test r8, r8" 4d85c0 0x0 (seq (set _res (& (var r8) (var r8))) (set r8 (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+a "sub r12, r11" 4d29dc 0x0 (seq (set op1 (var r12)) (set op2 (var r11)) (set sub (- (var op1) (var op2))) (set r12 (cast 64 false (var sub))) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
+a "test ebx, 0x12345678" f7c378563412 0x0 (seq (set _res (& (cast 32 false (var rbx)) (bv 32 0x12345678))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+a "test rbx, 0x12345678" 48f7c378563412 0x0 (seq (set _res (& (var rbx) (bv 64 0x12345678))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+a "test dword [eax], 0x12345678" 67f70078563412 0x0 (seq (set _res (& (loadw 0 32 (+ (cast 64 false (cast 32 false (var rax))) (bv 64 0x0))) (bv 32 0x12345678))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+a "test dword [rax], 0x12345678" f70078563412 0x0 (seq (set _res (& (loadw 0 32 (+ (var rax) (bv 64 0x0))) (bv 32 0x12345678))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+a "test qword [rcx], 0x12345678" 48f70178563412 0x0 (seq (set _res (& (loadw 0 64 (+ (var rcx) (bv 64 0x0))) (bv 64 0x12345678))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+a "test rax, rbx" 4885d8 0x0 (seq (set _res (& (var rax) (var rbx))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+a "test rcx, rcx" 4885c9 0x0 (seq (set _res (& (var rcx) (var rcx))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+a "test rdx, rsi" 4885f2 0x0 (seq (set _res (& (var rdx) (var rsi))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
+a "test r8, r8" 4d85c0 0x0 (seq (set _res (& (var r8) (var r8))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false))
 a "xor [rax], rax" 483100 0x0 (seq (set _xor (^ (loadw 0 64 (+ (var rax) (bv 64 0x0))) (var rax))) (storew 0 (+ (var rax) (bv 64 0x0)) (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
 a "xor [rsi], rbx" 48311e 0x0 (seq (set _xor (^ (loadw 0 64 (+ (var rsi) (bv 64 0x0))) (var rbx))) (storew 0 (+ (var rsi) (bv 64 0x0)) (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
 a "xor rax, rax" 4831c0 0x0 (seq (set _xor (^ (var rax) (var rax))) (set rax (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
@@ -198,23 +198,23 @@ ad "push r13" 4155 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (va
 ad "push r14" 4156 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (var r14))))
 ad "push r15" 4157 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (var r15))))
 
-ad "call r8" 41ffd0 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0))))
-ad "call r9" 41ffd1 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0))))
-ad "call r10" 41ffd2 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0))))
-ad "call r11" 41ffd3 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0))))
-ad "call r12" 41ffd4 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0))))
-ad "call r13" 41ffd5 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0))))
-ad "call r14" 41ffd6 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0))))
-ad "call r15" 41ffd7 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0))))
+ad "call r8" 41ffd0 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (bv 64 0x3))) (jmp (var r8)))
+ad "call r9" 41ffd1 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (bv 64 0x3))) (jmp (var r9)))
+ad "call r10" 41ffd2 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (bv 64 0x3))) (jmp (var r10)))
+ad "call r11" 41ffd3 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (bv 64 0x3))) (jmp (var r11)))
+ad "call r12" 41ffd4 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (bv 64 0x3))) (jmp (var r12)))
+ad "call r13" 41ffd5 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (bv 64 0x3))) (jmp (var r13)))
+ad "call r14" 41ffd6 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (bv 64 0x3))) (jmp (var r14)))
+ad "call r15" 41ffd7 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (bv 64 0x3))) (jmp (var r15)))
 a "mov dword ptr [rax],0x1" c70001000000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 32 0x1))
 a "mov qword [rax], 0x1" 48c70001000000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 64 0x1))
 a "mov [rax], 0x1" 48c70001000000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 64 0x1))
-a "mov byte ptr [rip+0x203cb8],0x1" c605b83c200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x203cb8)) (bv 8 0x1))
-a "mov dword ptr [rip+0x203817],0x42" c7051738200042000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x203817)) (bv 32 0x42))
-a "mov dword ptr [rip+0x20380b],0x54" c7050b38200054000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20380b)) (bv 32 0x54))
-a "mov dword ptr [rip+0x2037ff],0x4f" c705ff3720004f000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2037ff)) (bv 32 0x4f))
-a "mov dword ptr [rip+0x2037f3],0x49" c705f337200049000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2037f3)) (bv 32 0x49))
-a "mov dword ptr [rip+0x2037e7],0x30" c705e737200030000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2037e7)) (bv 32 0x30))
+a "mov byte ptr [rip+0x203cb8],0x1" c605b83c200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x203cb8)) (bv 8 0x1))
+a "mov dword ptr [rip+0x203817],0x42" c7051738200042000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x203817)) (bv 32 0x42))
+a "mov dword ptr [rip+0x20380b],0x54" c7050b38200054000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x20380b)) (bv 32 0x54))
+a "mov dword ptr [rip+0x2037ff],0x4f" c705ff3720004f000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x2037ff)) (bv 32 0x4f))
+a "mov dword ptr [rip+0x2037f3],0x49" c705f337200049000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x2037f3)) (bv 32 0x49))
+a "mov dword ptr [rip+0x2037e7],0x30" c705e737200030000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x2037e7)) (bv 32 0x30))
 a "mov byte ptr [rbp-0x110a],0x49" c685f6eeffff49 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffeef6)) (bv 8 0x49))
 a "mov dword ptr [rbp-0x1100],0x0" c78500efffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffef00)) (bv 32 0x0))
 a "mov dword ptr [rbp-0x10fc],0x0" c78504efffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffef04)) (bv 32 0x0))
@@ -247,16 +247,16 @@ a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8
 a "mov dword ptr [rbp-0x10],0xffffffff" c745f0ffffffff 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff0)) (bv 32 0xffffffff))
 a "mov dword ptr [rbp-0x10],0x1" c745f001000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff0)) (bv 32 0x1))
 a "mov dword ptr [rbp-0x4],0x1" c745fc01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffffc)) (bv 32 0x1))
-a "mov byte ptr [rip+0x207200],0x1" c6050072200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x207200)) (bv 8 0x1))
+a "mov byte ptr [rip+0x207200],0x1" c6050072200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x207200)) (bv 8 0x1))
 a "mov dword ptr [rbp-0xc],0x0" c745f400000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff4)) (bv 32 0x0))
-a "mov qword ptr [rip+0x2687bd],0x0" 48c705bd87260000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2687bd)) (bv 64 0x0))
+a "mov qword ptr [rip+0x2687bd],0x0" 48c705bd87260000000000 0x0 (storew 0 (+ (bv 64 0xb) (bv 64 0x2687bd)) (bv 64 0x0))
 a "mov dword ptr [rbp-0x18c],0x0" c78574feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe74)) (bv 32 0x0))
 a "mov dword ptr [rbp-0x18c],0x1" c78574feffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe74)) (bv 32 0x1))
 a "mov dword ptr [rbp-0x114],0x0" c785ecfeffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffeec)) (bv 32 0x0))
 a "mov qword ptr [rbp-0x20],0x0" 48c745e000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe0)) (bv 64 0x0))
 a "mov qword ptr [rbp-0x18],0x0" 48c745e800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe8)) (bv 64 0x0))
 a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0))
-a "mov qword ptr [rip+0x2068f4],0x0" 48c705f468200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2068f4)) (bv 64 0x0))
+a "mov qword ptr [rip+0x2068f4],0x0" 48c705f468200000000000 0x0 (storew 0 (+ (bv 64 0xb) (bv 64 0x2068f4)) (bv 64 0x0))
 a "mov byte ptr [rbp-0x31],0x0" c645cf00 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffcf)) (bv 8 0x0))
 a "mov byte ptr [rbp-0x31],0x1" c645cf01 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffcf)) (bv 8 0x1))
 a "mov qword ptr [rbp-0x28],0x0" 48c745d800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd8)) (bv 64 0x0))
@@ -293,7 +293,7 @@ a "mov qword ptr [rbp-0x200],0x0" 48c78500feffff00000000 0x0 (storew 0 (+ (var r
 a "mov byte ptr [rbp-0x2ce],0x0" c68532fdffff00 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd32)) (bv 8 0x0))
 a "mov dword ptr [rbp-0x2b8],0x1" c78548fdffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd48)) (bv 32 0x1))
 a "mov dword ptr [rbp-0x2b8],0x0" c78548fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd48)) (bv 32 0x0))
-a "mov dword ptr [rip+0x267855],0x1" c7055578260001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x267855)) (bv 32 0x1))
+a "mov dword ptr [rip+0x267855],0x1" c7055578260001000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x267855)) (bv 32 0x1))
 a "mov byte ptr [rbp-0x2ce],0x1" c68532fdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd32)) (bv 8 0x1))
 a "mov byte ptr [rbp-0x2d3],0x1" c6852dfdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd2d)) (bv 8 0x1))
 a "mov byte ptr [rbp-0x2d0],0x1" c68530fdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd30)) (bv 8 0x1))
@@ -306,14 +306,14 @@ a "mov dword ptr [rbp-0x2ac],0x0" c78554fdffff00000000 0x0 (storew 0 (+ (var rbp
 a "mov byte ptr [rbp-0x2d0],0x1" c68530fdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd30)) (bv 8 0x1))
 a "mov byte ptr [rbp-0x2cf],0x1" c68531fdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd31)) (bv 8 0x1))
 a "mov byte ptr [rbp-0x2d0],0x1" c68530fdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd30)) (bv 8 0x1))
-a "mov byte ptr [rip+0x205ab2],0x1" c605b25a200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x205ab2)) (bv 8 0x1))
+a "mov byte ptr [rip+0x205ab2],0x1" c605b25a200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x205ab2)) (bv 8 0x1))
 a "mov byte ptr [rbp-0x2d2],0x1" c6852efdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd2e)) (bv 8 0x1))
-a "mov byte ptr [rip+0x205a32],0x1" c605325a200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x205a32)) (bv 8 0x1))
+a "mov byte ptr [rip+0x205a32],0x1" c605325a200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x205a32)) (bv 8 0x1))
 a "mov word ptr [rbp-0x98],0x6c" 66c78568ffffff6c00 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff68)) (bv 16 0x6c))
 a "mov qword ptr [rbp-0x1f8],0x0" 48c78508feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe08)) (bv 64 0x0))
 a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0))
 a "mov qword ptr [rbp-0x248],0x0" 48c785b8fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdb8)) (bv 64 0x0))
-a "mov byte ptr [rip+0x205443],0x1" c6054354200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x205443)) (bv 8 0x1))
+a "mov byte ptr [rip+0x205443],0x1" c6054354200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x205443)) (bv 8 0x1))
 a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0))
 a "mov dword ptr [rbp-0x2c4],0x2" c7853cfdffff02000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd3c)) (bv 32 0x2))
 a "mov dword ptr [rbp-0x2e4],0x2" c7851cfdffff02000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd1c)) (bv 32 0x2))
@@ -334,11 +334,11 @@ a "mov dword ptr [rax+0x8],0xffffffff" c74008ffffffff 0x0 (storew 0 (+ (var rax)
 a "mov qword ptr [rax+0x10],0x0" 48c7401000000000 0x0 (storew 0 (+ (var rax) (bv 64 0x10)) (bv 64 0x0))
 a "mov qword ptr [rbp-0x288],0x0" 48c78578fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd78)) (bv 64 0x0))
 a "mov qword ptr [rbp-0x280],0x0" 48c78580fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd80)) (bv 64 0x0))
-a "mov byte ptr [rip+0x2049a0],0x1" c605a049200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2049a0)) (bv 8 0x1))
-a "mov qword ptr [rip+0x20489f],0x0" 48c7059f48200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20489f)) (bv 64 0x0))
-a "mov qword ptr [rip+0x2047f9],0x0" 48c705f947200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2047f9)) (bv 64 0x0))
-a "mov dword ptr [rip+0x2047c7],0x1" c705c747200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2047c7)) (bv 32 0x1))
-a "mov dword ptr [rip+0x2047b6],0x0" c705b647200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2047b6)) (bv 32 0x0))
+a "mov byte ptr [rip+0x2049a0],0x1" c605a049200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x2049a0)) (bv 8 0x1))
+a "mov qword ptr [rip+0x20489f],0x0" 48c7059f48200000000000 0x0 (storew 0 (+ (bv 64 0xb) (bv 64 0x20489f)) (bv 64 0x0))
+a "mov qword ptr [rip+0x2047f9],0x0" 48c705f947200000000000 0x0 (storew 0 (+ (bv 64 0xb) (bv 64 0x2047f9)) (bv 64 0x0))
+a "mov dword ptr [rip+0x2047c7],0x1" c705c747200001000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x2047c7)) (bv 32 0x1))
+a "mov dword ptr [rip+0x2047b6],0x0" c705b647200000000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x2047b6)) (bv 32 0x0))
 a "mov dword ptr [rbp-0x4],0x0" c745fc00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffffc)) (bv 32 0x0))
 a "mov dword ptr [rbp-0x78],0x0" c7458800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff88)) (bv 32 0x0))
 a "mov byte ptr [rbp-0x79],0x1" c6458701 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff87)) (bv 8 0x1))
@@ -371,55 +371,55 @@ a "mov dword ptr [rbp-0xd0],0x1" c78530ffffff01000000 0x0 (storew 0 (+ (var rbp)
 a "mov dword ptr [rbp-0xcc],0x1" c78534ffffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff34)) (bv 32 0x1))
 a "mov dword ptr [rbp-0xd8],0x1" c78528ffffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff28)) (bv 32 0x1))
 a "mov dword ptr [rbp-0xd8],0x2" c78528ffffff02000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff28)) (bv 32 0x2))
-a "mov dword ptr [rip+0x2032e9],0x0" c705e932200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2032e9)) (bv 32 0x0))
+a "mov dword ptr [rip+0x2032e9],0x0" c705e932200000000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x2032e9)) (bv 32 0x0))
 a "mov dword ptr [rbp-0xc0],0x0" c78540ffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff40)) (bv 32 0x0))
 a "mov dword ptr [rbp-0xc0],0x1" c78540ffffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff40)) (bv 32 0x1))
 a "mov byte ptr [rbp-0xe1],0x0" c6851fffffff00 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff1f)) (bv 8 0x0))
-a "mov qword ptr [rip+0x202ebe],0x0" 48c705be2e200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202ebe)) (bv 64 0x0))
+a "mov qword ptr [rip+0x202ebe],0x0" 48c705be2e200000000000 0x0 (storew 0 (+ (bv 64 0xb) (bv 64 0x202ebe)) (bv 64 0x0))
 a "mov dword ptr [rbp-0xe0],0x0" c78520ffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff20)) (bv 32 0x0))
 a "mov qword ptr [rbp-0x50],0x0" 48c745b000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffb0)) (bv 64 0x0))
 a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0))
 a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0))
 a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0))
 a "mov qword ptr [rbp-0xa8],0x1" 48c78558ffffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff58)) (bv 64 0x1))
-a "mov qword ptr [rip+0x202865],0x0" 48c7056528200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202865)) (bv 64 0x0))
+a "mov qword ptr [rip+0x202865],0x0" 48c7056528200000000000 0x0 (storew 0 (+ (bv 64 0xb) (bv 64 0x202865)) (bv 64 0x0))
 a "mov dword ptr [rbp-0xe0],0x0" c78520ffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff20)) (bv 32 0x0))
 a "mov dword ptr [rbp-0xdc],0x0" c78524ffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff24)) (bv 32 0x0))
-a "mov byte ptr [rip+0x2013e0],0x1" c605e013200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2013e0)) (bv 8 0x1))
+a "mov byte ptr [rip+0x2013e0],0x1" c605e013200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x2013e0)) (bv 8 0x1))
 a "mov byte ptr [rbp-0x2d],0x0" c645d300 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd3)) (bv 8 0x0))
 a "mov dword ptr [rbp-0x28],0x0" c745d800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd8)) (bv 32 0x0))
 a "mov byte ptr [rbp-0x2d],0x1" c645d301 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd3)) (bv 8 0x1))
-a "mov byte ptr [rip+0x201f30],0x1" c605301f200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x201f30)) (bv 8 0x1))
+a "mov byte ptr [rip+0x201f30],0x1" c605301f200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x201f30)) (bv 8 0x1))
 a "mov dword ptr [rbp-0xc],0x0" c745f400000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff4)) (bv 32 0x0))
 a "mov dword ptr [rax],0x2e2e2e" c7002e2e2e00 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 32 0x2e2e2e))
 a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0))
 a "mov byte ptr [rbp-0x2d],0x0" c645d300 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd3)) (bv 8 0x0))
 a "mov byte ptr [rbp-0x2d],0x1" c645d301 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd3)) (bv 8 0x1))
-a "mov dword ptr [rip+0x2015f2],0x1" c705f215200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2015f2)) (bv 32 0x1))
-a "mov byte ptr [rip+0x201606],0x1" c6050616200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x201606)) (bv 8 0x1))
-a "mov dword ptr [rip+0x2015f3],0x1" c705f315200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2015f3)) (bv 32 0x1))
-a "mov dword ptr [rip+0x20159c],0x7" c7059c15200007000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20159c)) (bv 32 0x7))
-a "mov dword ptr [rip+0x20158d],0x1" c7058d15200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20158d)) (bv 32 0x1))
-a "mov dword ptr [rip+0x2015eb],0x0" c705eb15200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2015eb)) (bv 32 0x0))
-a "mov dword ptr [rip+0x201558],0x0" c7055815200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x201558)) (bv 32 0x0))
-a "mov dword ptr [rip+0x2015b6],0x0" c705b615200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2015b6)) (bv 32 0x0))
-a "mov dword ptr [rip+0x2015b0],0x0" c705b015200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2015b0)) (bv 32 0x0))
-a "mov dword ptr [rip+0x201519],0x0" c7051915200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x201519)) (bv 32 0x0))
-a "mov dword ptr [rip+0x201577],0x0" c7057715200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x201577)) (bv 32 0x0))
-a "mov dword ptr [rip+0x201571],0x1" c7057115200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x201571)) (bv 32 0x1))
-a "mov dword ptr [rip+0x2014b7],0x0" c705b714200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2014b7)) (bv 32 0x0))
-a "mov dword ptr [rip+0x201515],0x1" c7051515200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x201515)) (bv 32 0x1))
-a "mov dword ptr [rip+0x20150f],0x0" c7050f15200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20150f)) (bv 32 0x0))
-a "mov dword ptr [rip+0x2013e2],0x3" c705e213200003000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2013e2)) (bv 32 0x3))
-a "mov dword ptr [rip+0x2013fe],0x1" c705fe13200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2013fe)) (bv 32 0x1))
-a "mov byte ptr [rip+0x204578],0x1" c6057845200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x204578)) (bv 8 0x1))
+a "mov dword ptr [rip+0x2015f2],0x1" c705f215200001000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x2015f2)) (bv 32 0x1))
+a "mov byte ptr [rip+0x201606],0x1" c6050616200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x201606)) (bv 8 0x1))
+a "mov dword ptr [rip+0x2015f3],0x1" c705f315200001000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x2015f3)) (bv 32 0x1))
+a "mov dword ptr [rip+0x20159c],0x7" c7059c15200007000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x20159c)) (bv 32 0x7))
+a "mov dword ptr [rip+0x20158d],0x1" c7058d15200001000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x20158d)) (bv 32 0x1))
+a "mov dword ptr [rip+0x2015eb],0x0" c705eb15200000000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x2015eb)) (bv 32 0x0))
+a "mov dword ptr [rip+0x201558],0x0" c7055815200000000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x201558)) (bv 32 0x0))
+a "mov dword ptr [rip+0x2015b6],0x0" c705b615200000000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x2015b6)) (bv 32 0x0))
+a "mov dword ptr [rip+0x2015b0],0x0" c705b015200000000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x2015b0)) (bv 32 0x0))
+a "mov dword ptr [rip+0x201519],0x0" c7051915200000000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x201519)) (bv 32 0x0))
+a "mov dword ptr [rip+0x201577],0x0" c7057715200000000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x201577)) (bv 32 0x0))
+a "mov dword ptr [rip+0x201571],0x1" c7057115200001000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x201571)) (bv 32 0x1))
+a "mov dword ptr [rip+0x2014b7],0x0" c705b714200000000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x2014b7)) (bv 32 0x0))
+a "mov dword ptr [rip+0x201515],0x1" c7051515200001000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x201515)) (bv 32 0x1))
+a "mov dword ptr [rip+0x20150f],0x0" c7050f15200000000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x20150f)) (bv 32 0x0))
+a "mov dword ptr [rip+0x2013e2],0x3" c705e213200003000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x2013e2)) (bv 32 0x3))
+a "mov dword ptr [rip+0x2013fe],0x1" c705fe13200001000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x2013fe)) (bv 32 0x1))
+a "mov byte ptr [rip+0x204578],0x1" c6057845200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x204578)) (bv 8 0x1))
 a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0))
 a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0))
 a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe98)) (bv 32 0x0))
 a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe98)) (bv 32 0x0))
 a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe98)) (bv 32 0x0))
 a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe98)) (bv 32 0x0))
-a "mov dword ptr [rip+0x203d10],0x1" c705103d200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x203d10)) (bv 32 0x1))
+a "mov dword ptr [rip+0x203d10],0x1" c705103d200001000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x203d10)) (bv 32 0x1))
 a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe98)) (bv 32 0x0))
 a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe98)) (bv 32 0x0))
 a "mov dword ptr [rbp-0x164],0x0" c7859cfeffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe9c)) (bv 32 0x0))
@@ -476,29 +476,29 @@ a "mov dword ptr [rbp-0x98],0x0" c78568ffffff00000000 0x0 (storew 0 (+ (var rbp)
 a "mov dword ptr [rbp-0x94],0x0" c7856cffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x0))
 a "mov dword ptr [rbp-0x90],0x0" c78570ffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff70)) (bv 32 0x0))
 a "mov dword ptr [rbp-0x8c],0xffffffff" c78574ffffffffffffff 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff74)) (bv 32 0xffffffff))
-a "mov dword ptr [rip+0x202447],0x42" c7054724200042000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202447)) (bv 32 0x42))
-a "mov dword ptr [rip+0x2023db],0x0" c705db23200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2023db)) (bv 32 0x0))
-a "mov dword ptr [rip+0x202408],0x72" c7050824200072000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202408)) (bv 32 0x72))
+a "mov dword ptr [rip+0x202447],0x42" c7054724200042000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x202447)) (bv 32 0x42))
+a "mov dword ptr [rip+0x2023db],0x0" c705db23200000000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x2023db)) (bv 32 0x0))
+a "mov dword ptr [rip+0x202408],0x72" c7050824200072000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x202408)) (bv 32 0x72))
 a "mov dword ptr [rbp-0x94],0x7" c7856cffffff07000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x7))
-a "mov dword ptr [rip+0x2023b3],0x1" c705b323200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2023b3)) (bv 32 0x1))
+a "mov dword ptr [rip+0x2023b3],0x1" c705b323200001000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x2023b3)) (bv 32 0x1))
 a "mov dword ptr [rbp-0x94],0x6" c7856cffffff06000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x6))
 a "mov dword ptr [rbp-0x94],0x2" c7856cffffff02000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x2))
-a "mov dword ptr [rip+0x20238e],0x1" c7058e23200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20238e)) (bv 32 0x1))
+a "mov dword ptr [rip+0x20238e],0x1" c7058e23200001000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x20238e)) (bv 32 0x1))
 a "mov dword ptr [rbp-0x90],0x1" c78570ffffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff70)) (bv 32 0x1))
 a "mov dword ptr [rbp-0x98],0x1" c78568ffffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff68)) (bv 32 0x1))
-a "mov byte ptr [rip+0x202337],0x1" c6053723200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202337)) (bv 8 0x1))
-a "mov byte ptr [rip+0x20232f],0x0" c6052f23200000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20232f)) (bv 8 0x0))
+a "mov byte ptr [rip+0x202337],0x1" c6053723200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x202337)) (bv 8 0x1))
+a "mov byte ptr [rip+0x20232f],0x0" c6052f23200000 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x20232f)) (bv 8 0x0))
 a "mov dword ptr [rbp-0x94],0x6" c7856cffffff06000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x6))
-a "mov byte ptr [rip+0x202319],0x1" c6051923200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202319)) (bv 8 0x1))
+a "mov byte ptr [rip+0x202319],0x1" c6051923200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x202319)) (bv 8 0x1))
 a "mov dword ptr [rbp-0x94],0x5" c7856cffffff05000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x5))
 a "mov dword ptr [rbp-0x94],0x4" c7856cffffff04000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x4))
 a "mov dword ptr [rbp-0x94],0x3" c7856cffffff03000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x3))
 a "mov dword ptr [rbp-0x94],0x8" c7856cffffff08000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x8))
-a "mov dword ptr [rip+0x20229f],0x75" c7059f22200075000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20229f)) (bv 32 0x75))
-a "mov dword ptr [rip+0x202293],0x55" c7059322200055000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202293)) (bv 32 0x55))
-a "mov byte ptr [rip+0x20227f],0x1" c6057f22200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20227f)) (bv 8 0x1))
-a "mov byte ptr [rip+0x202294],0x1" c6059422200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202294)) (bv 8 0x1))
-a "mov dword ptr [rip+0x202264],0x6a" c705642220006a000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202264)) (bv 32 0x6a))
+a "mov dword ptr [rip+0x20229f],0x75" c7059f22200075000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x20229f)) (bv 32 0x75))
+a "mov dword ptr [rip+0x202293],0x55" c7059322200055000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x202293)) (bv 32 0x55))
+a "mov byte ptr [rip+0x20227f],0x1" c6057f22200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x20227f)) (bv 8 0x1))
+a "mov byte ptr [rip+0x202294],0x1" c6059422200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x202294)) (bv 8 0x1))
+a "mov dword ptr [rip+0x202264],0x6a" c705642220006a000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x202264)) (bv 32 0x6a))
 a "mov dword ptr [rbp-0x94],0x1" c7856cffffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x1))
 a "mov dword ptr [rbp-0x94],0x0" c7856cffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x0))
 a "mov dword ptr [rbp-0x88],0x40" c78578ffffff40000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff78)) (bv 32 0x40))
@@ -506,7 +506,7 @@ a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8
 a "mov dword ptr [rax+0x24],0x6c" c740246c000000 0x0 (storew 0 (+ (var rax) (bv 64 0x24)) (bv 32 0x6c))
 a "mov dword ptr [rax+0x24],0x6d" c740246d000000 0x0 (storew 0 (+ (var rax) (bv 64 0x24)) (bv 32 0x6d))
 a "mov dword ptr [rax+0x24],0x0" c7402400000000 0x0 (storew 0 (+ (var rax) (bv 64 0x24)) (bv 32 0x0))
-a "mov byte ptr [rip+0x206cd8],0x1" c605d86c200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x206cd8)) (bv 8 0x1))
+a "mov byte ptr [rip+0x206cd8],0x1" c605d86c200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x206cd8)) (bv 8 0x1))
 a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0))
 a "mov dword ptr [rbp-0x64],0x0" c7459c00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff9c)) (bv 32 0x0))
 a "mov qword ptr [rbp-0x50],0x0" 48c745b000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffb0)) (bv 64 0x0))
@@ -549,19 +549,19 @@ a "mov qword ptr [rbp-0x618d0],0x0" 48c78530e7f9ff00000000 0x0 (storew 0 (+ (var
 a "mov dword ptr [rbp-0x61938],0x0" c785c8e6f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6c8)) (bv 32 0x0))
 a "mov dword ptr [rbp-0x6194c],0x0" c785b4e6f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6b4)) (bv 32 0x0))
 a "mov dword ptr [rbp-0x61948],0xffffffff" c785b8e6f9ffffffffff 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6b8)) (bv 32 0xffffffff))
-a "mov dword ptr [rip+0x20531b],0x8" c7051b53200008000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20531b)) (bv 32 0x8))
+a "mov dword ptr [rip+0x20531b],0x8" c7051b53200008000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x20531b)) (bv 32 0x8))
 a "mov dword ptr [rax+0x190],0x0" c7809001000000000000 0x0 (storew 0 (+ (var rax) (bv 64 0x190)) (bv 32 0x0))
-a "mov dword ptr [rip+0x20525c],0x40" c7055c52200040000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20525c)) (bv 32 0x40))
+a "mov dword ptr [rip+0x20525c],0x40" c7055c52200040000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x20525c)) (bv 32 0x40))
 a "mov dword ptr [rbp-0x6194c],0x2" c785b4e6f9ff02000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6b4)) (bv 32 0x2))
 a "mov dword ptr [rbp-0x6194c],0x1" c785b4e6f9ff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6b4)) (bv 32 0x1))
-a "mov dword ptr [rip+0x204e5f],0x1" c7055f4e200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x204e5f)) (bv 32 0x1))
-a "mov dword ptr [rip+0x204d51],0x0" c705514d200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x204d51)) (bv 32 0x0))
-a "mov dword ptr [rip+0x204d6a],0x1" c7056a4d200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x204d6a)) (bv 32 0x1))
-a "mov dword ptr [rip+0x204cdc],0x0" c705dc4c200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x204cdc)) (bv 32 0x0))
+a "mov dword ptr [rip+0x204e5f],0x1" c7055f4e200001000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x204e5f)) (bv 32 0x1))
+a "mov dword ptr [rip+0x204d51],0x0" c705514d200000000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x204d51)) (bv 32 0x0))
+a "mov dword ptr [rip+0x204d6a],0x1" c7056a4d200001000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x204d6a)) (bv 32 0x1))
+a "mov dword ptr [rip+0x204cdc],0x0" c705dc4c200000000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x204cdc)) (bv 32 0x0))
 a "mov qword ptr [rbp-0x618e8],0x0" 48c78518e7f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e718)) (bv 64 0x0))
 a "mov qword ptr [rbp-0x618e0],0x0" 48c78520e7f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e720)) (bv 64 0x0))
 a "mov qword ptr [rbp-0x618e0],0x0" 48c78520e7f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e720)) (bv 64 0x0))
-a "mov qword ptr [rip+0x2049d8],0x0" 48c705d849200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2049d8)) (bv 64 0x0))
+a "mov qword ptr [rip+0x2049d8],0x0" 48c705d849200000000000 0x0 (storew 0 (+ (bv 64 0xb) (bv 64 0x2049d8)) (bv 64 0x0))
 a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0))
 a "mov qword ptr [rbp-0x618d8],0x0" 48c78528e7f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e728)) (bv 64 0x0))
 a "mov qword ptr [rbp-0x61898],0x0" 48c78568e7f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e768)) (bv 64 0x0))
@@ -575,7 +575,7 @@ a "mov dword ptr [rbp-0x6193c],0x1" c785c4e6f9ff01000000 0x0 (storew 0 (+ (var r
 a "mov dword ptr [rbp-0x6194c],0x0" c785b4e6f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6b4)) (bv 32 0x0))
 a "mov dword ptr [rax+0x40c],0x0" c7800c04000000000000 0x0 (storew 0 (+ (var rax) (bv 64 0x40c)) (bv 32 0x0))
 a "mov qword ptr [rbp-0x618c8],0x0" 48c78538e7f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e738)) (bv 64 0x0))
-a "mov byte ptr [rip+0x2037e8],0x1" c605e837200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2037e8)) (bv 8 0x1))
+a "mov byte ptr [rip+0x2037e8],0x1" c605e837200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x2037e8)) (bv 8 0x1))
 a "mov qword ptr [rbp-0x4a0],0x0" 48c78560fbffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffb60)) (bv 64 0x0))
 a "mov qword ptr [rbp-0x508],0x0" 48c785f8faffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffaf8)) (bv 64 0x0))
 a "mov qword ptr [rbp-0x500],0x0" 48c78500fbffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffb00)) (bv 64 0x0))
@@ -618,7 +618,7 @@ a "mov qword ptr [rbp-0x4f8],0x0" 48c78508fbffff00000000 0x0 (storew 0 (+ (var r
 a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0))
 a "mov dword ptr [rbp-0x52c],0x0" c785d4faffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffad4)) (bv 32 0x0))
 a "mov dword ptr [rbp-0x52c],0x0" c785d4faffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffad4)) (bv 32 0x0))
-a "mov byte ptr [rip+0x201148],0x1" c6054811200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x201148)) (bv 8 0x1))
+a "mov byte ptr [rip+0x201148],0x1" c6054811200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x201148)) (bv 8 0x1))
 a "mov dword ptr [rbp-0x5c],0x3" c745a403000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffa4)) (bv 32 0x3))
 a "mov dword ptr [rbp-0x64],0x0" c7459c00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff9c)) (bv 32 0x0))
 a "mov dword ptr [rbp-0x60],0x0" c745a000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffa0)) (bv 32 0x0))
@@ -628,7 +628,7 @@ a "mov dword ptr [rbp-0x60],0x1" c745a001000000 0x0 (storew 0 (+ (var rbp) (bv 6
 a "mov dword ptr [rbp-0x64],0x1" c7459c01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff9c)) (bv 32 0x1))
 a "mov qword ptr [rbp-0x38],0x0" 48c745c800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffc8)) (bv 64 0x0))
 a "mov qword ptr [rbp-0x38],0x0" 48c745c800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffc8)) (bv 64 0x0))
-a "mov byte ptr [rip+0x204568],0x1" c6056845200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x204568)) (bv 8 0x1))
+a "mov byte ptr [rip+0x204568],0x1" c6056845200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x204568)) (bv 8 0x1))
 a "mov dword ptr [rbp-0x210],0x0" c785f0fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdf0)) (bv 32 0x0))
 a "mov dword ptr [rbp-0x1d0],0x0" c78530feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe30)) (bv 32 0x0))
 a "mov dword ptr [rbp-0x70],0x0" c7459000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff90)) (bv 32 0x0))
@@ -678,15 +678,15 @@ a "mov byte ptr [rbp-0x212],0x0" c685eefdffff00 0x0 (storew 0 (+ (var rbp) (bv 6
 a "mov dword ptr [rbp-0x1e8],0x40" c78518feffff40000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe18)) (bv 32 0x40))
 a "mov byte ptr [rbp-0x212],0x1" c685eefdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdee)) (bv 8 0x1))
 a "mov dword ptr [rbp-0x200],0x1" c78500feffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe00)) (bv 32 0x1))
-a "mov dword ptr [rip+0x202b89],0x1" c705892b200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202b89)) (bv 32 0x1))
+a "mov dword ptr [rip+0x202b89],0x1" c705892b200001000000 0x0 (storew 0 (+ (bv 64 0xa) (bv 64 0x202b89)) (bv 32 0x1))
 a "mov dword ptr [rbp-0x208],0x1" c785f8fdffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdf8)) (bv 32 0x1))
 a "mov dword ptr [rbp-0x208],0x2" c785f8fdffff02000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdf8)) (bv 32 0x2))
 a "mov byte ptr [rbp-0x215],0x1" c685ebfdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdeb)) (bv 8 0x1))
 a "mov dword ptr [rbp-0x208],0x3" c785f8fdffff03000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdf8)) (bv 32 0x3))
-a "mov byte ptr [rip+0x202af2],0x1" c605f22a200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202af2)) (bv 8 0x1))
+a "mov byte ptr [rip+0x202af2],0x1" c605f22a200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x202af2)) (bv 8 0x1))
 a "mov dword ptr [rbp-0x1fc],0x1" c78504feffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe04)) (bv 32 0x1))
 a "mov byte ptr [rbp-0x213],0x1" c685edfdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffded)) (bv 8 0x1))
-a "mov byte ptr [rip+0x2029f3],0x1" c605f329200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2029f3)) (bv 8 0x1))
+a "mov byte ptr [rip+0x2029f3],0x1" c605f329200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x2029f3)) (bv 8 0x1))
 a "mov byte ptr [rbp-0x214],0x1" c685ecfdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdec)) (bv 8 0x1))
 a "mov dword ptr [rbp-0x1f4],0x1" c7850cfeffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe0c)) (bv 32 0x1))
 a "mov dword ptr [rbp-0x1fc],0x0" c78504feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe04)) (bv 32 0x0))
@@ -704,8 +704,8 @@ a "mov dword ptr [rbp-0x1fc],0x1" c78504feffff01000000 0x0 (storew 0 (+ (var rbp
 a "mov byte ptr [rbp+rax*1-0x120],0x0" c68405e0feffff00 0x0 (storew 0 (+ (+ (var rbp) (* (var rax) (bv 64 0x1))) (bv 64 0xfffffffffffffee0)) (bv 8 0x0))
 a "mov byte ptr [rbp+rax*1-0x120],0x0" c68405e0feffff00 0x0 (storew 0 (+ (+ (var rbp) (* (var rax) (bv 64 0x1))) (bv 64 0xfffffffffffffee0)) (bv 8 0x0))
 a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0))
-a "mov byte ptr [rip+0x201cd3],0x1" c605d31c200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x201cd3)) (bv 8 0x1))
-a "mov byte ptr [rip+0x206f90],0x1" c605906f200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x206f90)) (bv 8 0x1))
+a "mov byte ptr [rip+0x201cd3],0x1" c605d31c200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x201cd3)) (bv 8 0x1))
+a "mov byte ptr [rip+0x206f90],0x1" c605906f200001 0x0 (storew 0 (+ (bv 64 0x7) (bv 64 0x206f90)) (bv 8 0x1))
 a "mov qword ptr [rbp-0x10],0x0" 48c745f000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff0)) (bv 64 0x0))
 a "mov byte ptr [rax+0xc8],0x0" c680c800000000 0x0 (storew 0 (+ (var rax) (bv 64 0xc8)) (bv 8 0x0))
 a "mov dword ptr [rax+0xb0],0xffffffff" c780b0000000ffffffff 0x0 (storew 0 (+ (var rax) (bv 64 0xb0)) (bv 32 0xffffffff))
@@ -838,7 +838,7 @@ a "inc DWORD PTR [rdi+0x28]" ff4728 0x0 (seq (set _op (loadw 0 32 (+ (var rdi) (
 a "inc DWORD PTR [rdx]" ff02 0x0 (seq (set _op (loadw 0 32 (+ (var rdx) (bv 64 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var rdx) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
 a "inc DWORD PTR [rdx+0x10]" ff4210 0x0 (seq (set _op (loadw 0 32 (+ (var rdx) (bv 64 0x10)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var rdx) (bv 64 0x10)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
 a "inc DWORD PTR [rdx+rax*1]" ff0402 0x0 (seq (set _op (loadw 0 32 (+ (+ (var rdx) (* (var rax) (bv 64 0x1))) (bv 64 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (+ (var rdx) (* (var rax) (bv 64 0x1))) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
-a "inc DWORD PTR [rip+0x2009c8]" ff05c8092000 0x0 (seq (set _op (loadw 0 32 (+ (bv 64 0x0) (bv 64 0x2009c8)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (bv 64 0x0) (bv 64 0x2009c8)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+a "inc DWORD PTR [rip+0x2009c8]" ff05c8092000 0x0 (seq (set _op (loadw 0 32 (+ (bv 64 0x6) (bv 64 0x2009c8)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (bv 64 0x6) (bv 64 0x2009c8)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
 a "inc DWORD PTR [rsi+0x8]" ff4608 0x0 (seq (set _op (loadw 0 32 (+ (var rsi) (bv 64 0x8)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var rsi) (bv 64 0x8)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
 a "inc DWORD PTR [rsp]" ff0424 0x0 (seq (set _op (loadw 0 32 (+ (var rsp) (bv 64 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var rsp) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
 a "inc DWORD PTR [rsp+0x10]" ff442410 0x0 (seq (set _op (loadw 0 32 (+ (var rsp) (bv 64 0x10)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var rsp) (bv 64 0x10)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
@@ -875,26 +875,26 @@ a "inc QWORD PTR [rdi+0x10]" 48ff4710 0x0 (seq (set _op (loadw 0 64 (+ (var rdi)
 a "inc QWORD PTR [rdi+rax*1+0xe1]" 48ff8407e1000000 0x0 (seq (set _op (loadw 0 64 (+ (+ (var rdi) (* (var rax) (bv 64 0x1))) (bv 64 0xe1)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (+ (var rdi) (* (var rax) (bv 64 0x1))) (bv 64 0xe1)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
 a "inc QWORD PTR [rdx]" 48ff02 0x0 (seq (set _op (loadw 0 64 (+ (var rdx) (bv 64 0x0)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (var rdx) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
 a "inc QWORD PTR [rdx+0x10]" 48ff4210 0x0 (seq (set _op (loadw 0 64 (+ (var rdx) (bv 64 0x10)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (var rdx) (bv 64 0x10)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
-a "inc QWORD PTR [rip+0x2121a1]" 48ff05a1212100 0x0 (seq (set _op (loadw 0 64 (+ (bv 64 0x0) (bv 64 0x2121a1)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (bv 64 0x0) (bv 64 0x2121a1)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+a "inc QWORD PTR [rip+0x2121a1]" 48ff05a1212100 0x0 (seq (set _op (loadw 0 64 (+ (bv 64 0x7) (bv 64 0x2121a1)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (bv 64 0x7) (bv 64 0x2121a1)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
 a "inc QWORD PTR [rsi]" 48ff06 0x0 (seq (set _op (loadw 0 64 (+ (var rsi) (bv 64 0x0)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (var rsi) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
 a "inc QWORD PTR [rsp]" 48ff0424 0x0 (seq (set _op (loadw 0 64 (+ (var rsp) (bv 64 0x0)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (var rsp) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
 a "inc QWORD PTR [rsp+0x1b8]" 48ff8424b8010000 0x0 (seq (set _op (loadw 0 64 (+ (var rsp) (bv 64 0x1b8)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (var rsp) (bv 64 0x1b8)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
-a "inc r10" 49ffc2 0x0 (seq (set _op (var r10)) (set _result (+ (var _op) (bv 64 0x1))) (set r10 (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
-a "inc r10d" 41ffc2 0x0 (seq (set _op (cast 32 false (var r10))) (set _result (+ (var _op) (bv 32 0x1))) (set r10 (| (& (var r10) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
-a "inc r11" 49ffc3 0x0 (seq (set _op (var r11)) (set _result (+ (var _op) (bv 64 0x1))) (set r11 (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
-a "inc r11d" 41ffc3 0x0 (seq (set _op (cast 32 false (var r11))) (set _result (+ (var _op) (bv 32 0x1))) (set r11 (| (& (var r11) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
-a "inc r12" 49ffc4 0x0 (seq (set _op (var r12)) (set _result (+ (var _op) (bv 64 0x1))) (set r12 (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
-a "inc r12d" 41ffc4 0x0 (seq (set _op (cast 32 false (var r12))) (set _result (+ (var _op) (bv 32 0x1))) (set r12 (| (& (var r12) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
-a "inc r13" 49ffc5 0x0 (seq (set _op (var r13)) (set _result (+ (var _op) (bv 64 0x1))) (set r13 (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
-a "inc r13d" 41ffc5 0x0 (seq (set _op (cast 32 false (var r13))) (set _result (+ (var _op) (bv 32 0x1))) (set r13 (| (& (var r13) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
-a "inc r14" 49ffc6 0x0 (seq (set _op (var r14)) (set _result (+ (var _op) (bv 64 0x1))) (set r14 (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
-a "inc r14d" 41ffc6 0x0 (seq (set _op (cast 32 false (var r14))) (set _result (+ (var _op) (bv 32 0x1))) (set r14 (| (& (var r14) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
-a "inc r15" 49ffc7 0x0 (seq (set _op (var r15)) (set _result (+ (var _op) (bv 64 0x1))) (set r15 (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
-a "inc r15d" 41ffc7 0x0 (seq (set _op (cast 32 false (var r15))) (set _result (+ (var _op) (bv 32 0x1))) (set r15 (| (& (var r15) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
-a "inc r8" 49ffc0 0x0 (seq (set _op (var r8)) (set _result (+ (var _op) (bv 64 0x1))) (set r8 (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
-a "inc r8d" 41ffc0 0x0 (seq (set _op (cast 32 false (var r8))) (set _result (+ (var _op) (bv 32 0x1))) (set r8 (| (& (var r8) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
-a "inc r9" 49ffc1 0x0 (seq (set _op (var r9)) (set _result (+ (var _op) (bv 64 0x1))) (set r9 (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
-a "inc r9d" 41ffc1 0x0 (seq (set _op (cast 32 false (var r9))) (set _result (+ (var _op) (bv 32 0x1))) (set r9 (| (& (var r9) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+a "inc r10" 49ffc2 0x0 (seq (set _op (var r10)) (set _result (+ (var _op) (bv 64 0x1))) (set r10 (cast 64 false (var _result))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+a "inc r10d" 41ffc2 0x0 (seq (set _op (cast 32 false (var r10))) (set _result (+ (var _op) (bv 32 0x1))) (set r10 (cast 64 false (var _result))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+a "inc r11" 49ffc3 0x0 (seq (set _op (var r11)) (set _result (+ (var _op) (bv 64 0x1))) (set r11 (cast 64 false (var _result))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+a "inc r11d" 41ffc3 0x0 (seq (set _op (cast 32 false (var r11))) (set _result (+ (var _op) (bv 32 0x1))) (set r11 (cast 64 false (var _result))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+a "inc r12" 49ffc4 0x0 (seq (set _op (var r12)) (set _result (+ (var _op) (bv 64 0x1))) (set r12 (cast 64 false (var _result))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+a "inc r12d" 41ffc4 0x0 (seq (set _op (cast 32 false (var r12))) (set _result (+ (var _op) (bv 32 0x1))) (set r12 (cast 64 false (var _result))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+a "inc r13" 49ffc5 0x0 (seq (set _op (var r13)) (set _result (+ (var _op) (bv 64 0x1))) (set r13 (cast 64 false (var _result))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+a "inc r13d" 41ffc5 0x0 (seq (set _op (cast 32 false (var r13))) (set _result (+ (var _op) (bv 32 0x1))) (set r13 (cast 64 false (var _result))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+a "inc r14" 49ffc6 0x0 (seq (set _op (var r14)) (set _result (+ (var _op) (bv 64 0x1))) (set r14 (cast 64 false (var _result))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+a "inc r14d" 41ffc6 0x0 (seq (set _op (cast 32 false (var r14))) (set _result (+ (var _op) (bv 32 0x1))) (set r14 (cast 64 false (var _result))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+a "inc r15" 49ffc7 0x0 (seq (set _op (var r15)) (set _result (+ (var _op) (bv 64 0x1))) (set r15 (cast 64 false (var _result))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+a "inc r15d" 41ffc7 0x0 (seq (set _op (cast 32 false (var r15))) (set _result (+ (var _op) (bv 32 0x1))) (set r15 (cast 64 false (var _result))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+a "inc r8" 49ffc0 0x0 (seq (set _op (var r8)) (set _result (+ (var _op) (bv 64 0x1))) (set r8 (cast 64 false (var _result))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+a "inc r8d" 41ffc0 0x0 (seq (set _op (cast 32 false (var r8))) (set _result (+ (var _op) (bv 32 0x1))) (set r8 (cast 64 false (var _result))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+a "inc r9" 49ffc1 0x0 (seq (set _op (var r9)) (set _result (+ (var _op) (bv 64 0x1))) (set r9 (cast 64 false (var _result))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
+a "inc r9d" 41ffc1 0x0 (seq (set _op (cast 32 false (var r9))) (set _result (+ (var _op) (bv 32 0x1))) (set r9 (cast 64 false (var _result))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
 a "inc rax" 48ffc0 0x0 (seq (set _op (var rax)) (set _result (+ (var _op) (bv 64 0x1))) (set rax (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
 a "inc rbp" 48ffc5 0x0 (seq (set _op (var rbp)) (set _result (+ (var _op) (bv 64 0x1))) (set rbp (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
 a "inc rbx" 48ffc3 0x0 (seq (set _op (var rbx)) (set _result (+ (var _op) (bv 64 0x1))) (set rbx (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))))
@@ -932,7 +932,7 @@ a "dec DWORD PTR [rdi+0x28]" ff4f28 0x0 (seq (set _op (loadw 0 32 (+ (var rdi) (
 a "dec DWORD PTR [rdx]" ff0a 0x0 (seq (set _op (loadw 0 32 (+ (var rdx) (bv 64 0x0)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var rdx) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
 a "dec DWORD PTR [rdx+0x10]" ff4a10 0x0 (seq (set _op (loadw 0 32 (+ (var rdx) (bv 64 0x10)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var rdx) (bv 64 0x10)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
 a "dec DWORD PTR [rdx+rax*1]" ff0c02 0x0 (seq (set _op (loadw 0 32 (+ (+ (var rdx) (* (var rax) (bv 64 0x1))) (bv 64 0x0)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (+ (var rdx) (* (var rax) (bv 64 0x1))) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "dec DWORD PTR [rip+0x2009c8]" ff0dc8092000 0x0 (seq (set _op (loadw 0 32 (+ (bv 64 0x0) (bv 64 0x2009c8)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (bv 64 0x0) (bv 64 0x2009c8)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
+a "dec DWORD PTR [rip+0x2009c8]" ff0dc8092000 0x0 (seq (set _op (loadw 0 32 (+ (bv 64 0x6) (bv 64 0x2009c8)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (bv 64 0x6) (bv 64 0x2009c8)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
 a "dec DWORD PTR [rsi+0x8]" ff4e08 0x0 (seq (set _op (loadw 0 32 (+ (var rsi) (bv 64 0x8)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var rsi) (bv 64 0x8)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
 a "dec DWORD PTR [rsp]" ff0c24 0x0 (seq (set _op (loadw 0 32 (+ (var rsp) (bv 64 0x0)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var rsp) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
 a "dec DWORD PTR [rsp+0x10]" ff4c2410 0x0 (seq (set _op (loadw 0 32 (+ (var rsp) (bv 64 0x10)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var rsp) (bv 64 0x10)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
@@ -969,26 +969,26 @@ a "dec QWORD PTR [rdi+0x10]" 48ff4f10 0x0 (seq (set _op (loadw 0 64 (+ (var rdi)
 a "dec QWORD PTR [rdi+rax*1+0xe1]" 48ff8c07e1000000 0x0 (seq (set _op (loadw 0 64 (+ (+ (var rdi) (* (var rax) (bv 64 0x1))) (bv 64 0xe1)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (+ (var rdi) (* (var rax) (bv 64 0x1))) (bv 64 0xe1)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
 a "dec QWORD PTR [rdx]" 48ff0a 0x0 (seq (set _op (loadw 0 64 (+ (var rdx) (bv 64 0x0)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (var rdx) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
 a "dec QWORD PTR [rdx+0x10]" 48ff4a10 0x0 (seq (set _op (loadw 0 64 (+ (var rdx) (bv 64 0x10)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (var rdx) (bv 64 0x10)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "dec QWORD PTR [rip+0x2121a1]" 48ff0da1212100 0x0 (seq (set _op (loadw 0 64 (+ (bv 64 0x0) (bv 64 0x2121a1)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (bv 64 0x0) (bv 64 0x2121a1)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
+a "dec QWORD PTR [rip+0x2121a1]" 48ff0da1212100 0x0 (seq (set _op (loadw 0 64 (+ (bv 64 0x7) (bv 64 0x2121a1)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (bv 64 0x7) (bv 64 0x2121a1)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
 a "dec QWORD PTR [rsi]" 48ff0e 0x0 (seq (set _op (loadw 0 64 (+ (var rsi) (bv 64 0x0)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (var rsi) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
 a "dec QWORD PTR [rsp]" 48ff0c24 0x0 (seq (set _op (loadw 0 64 (+ (var rsp) (bv 64 0x0)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (var rsp) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
 a "dec QWORD PTR [rsp+0x1b8]" 48ff8c24b8010000 0x0 (seq (set _op (loadw 0 64 (+ (var rsp) (bv 64 0x1b8)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (var rsp) (bv 64 0x1b8)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "dec r10" 49ffca 0x0 (seq (set _op (var r10)) (set _dec (- (var _op) (bv 64 0x1))) (set r10 (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "dec r10d" 41ffca 0x0 (seq (set _op (cast 32 false (var r10))) (set _dec (- (var _op) (bv 32 0x1))) (set r10 (| (& (var r10) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "dec r11" 49ffcb 0x0 (seq (set _op (var r11)) (set _dec (- (var _op) (bv 64 0x1))) (set r11 (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "dec r11d" 41ffcb 0x0 (seq (set _op (cast 32 false (var r11))) (set _dec (- (var _op) (bv 32 0x1))) (set r11 (| (& (var r11) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "dec r12" 49ffcc 0x0 (seq (set _op (var r12)) (set _dec (- (var _op) (bv 64 0x1))) (set r12 (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "dec r12d" 41ffcc 0x0 (seq (set _op (cast 32 false (var r12))) (set _dec (- (var _op) (bv 32 0x1))) (set r12 (| (& (var r12) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "dec r13" 49ffcd 0x0 (seq (set _op (var r13)) (set _dec (- (var _op) (bv 64 0x1))) (set r13 (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "dec r13d" 41ffcd 0x0 (seq (set _op (cast 32 false (var r13))) (set _dec (- (var _op) (bv 32 0x1))) (set r13 (| (& (var r13) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "dec r14" 49ffce 0x0 (seq (set _op (var r14)) (set _dec (- (var _op) (bv 64 0x1))) (set r14 (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "dec r14d" 41ffce 0x0 (seq (set _op (cast 32 false (var r14))) (set _dec (- (var _op) (bv 32 0x1))) (set r14 (| (& (var r14) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "dec r15" 49ffcf 0x0 (seq (set _op (var r15)) (set _dec (- (var _op) (bv 64 0x1))) (set r15 (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "dec r15d" 41ffcf 0x0 (seq (set _op (cast 32 false (var r15))) (set _dec (- (var _op) (bv 32 0x1))) (set r15 (| (& (var r15) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "dec r8" 49ffc8 0x0 (seq (set _op (var r8)) (set _dec (- (var _op) (bv 64 0x1))) (set r8 (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "dec r8d" 41ffc8 0x0 (seq (set _op (cast 32 false (var r8))) (set _dec (- (var _op) (bv 32 0x1))) (set r8 (| (& (var r8) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "dec r9" 49ffc9 0x0 (seq (set _op (var r9)) (set _dec (- (var _op) (bv 64 0x1))) (set r9 (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
-a "dec r9d" 41ffc9 0x0 (seq (set _op (cast 32 false (var r9))) (set _dec (- (var _op) (bv 32 0x1))) (set r9 (| (& (var r9) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
+a "dec r10" 49ffca 0x0 (seq (set _op (var r10)) (set _dec (- (var _op) (bv 64 0x1))) (set r10 (cast 64 false (var _dec))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
+a "dec r10d" 41ffca 0x0 (seq (set _op (cast 32 false (var r10))) (set _dec (- (var _op) (bv 32 0x1))) (set r10 (cast 64 false (var _dec))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
+a "dec r11" 49ffcb 0x0 (seq (set _op (var r11)) (set _dec (- (var _op) (bv 64 0x1))) (set r11 (cast 64 false (var _dec))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
+a "dec r11d" 41ffcb 0x0 (seq (set _op (cast 32 false (var r11))) (set _dec (- (var _op) (bv 32 0x1))) (set r11 (cast 64 false (var _dec))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
+a "dec r12" 49ffcc 0x0 (seq (set _op (var r12)) (set _dec (- (var _op) (bv 64 0x1))) (set r12 (cast 64 false (var _dec))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
+a "dec r12d" 41ffcc 0x0 (seq (set _op (cast 32 false (var r12))) (set _dec (- (var _op) (bv 32 0x1))) (set r12 (cast 64 false (var _dec))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
+a "dec r13" 49ffcd 0x0 (seq (set _op (var r13)) (set _dec (- (var _op) (bv 64 0x1))) (set r13 (cast 64 false (var _dec))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
+a "dec r13d" 41ffcd 0x0 (seq (set _op (cast 32 false (var r13))) (set _dec (- (var _op) (bv 32 0x1))) (set r13 (cast 64 false (var _dec))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
+a "dec r14" 49ffce 0x0 (seq (set _op (var r14)) (set _dec (- (var _op) (bv 64 0x1))) (set r14 (cast 64 false (var _dec))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
+a "dec r14d" 41ffce 0x0 (seq (set _op (cast 32 false (var r14))) (set _dec (- (var _op) (bv 32 0x1))) (set r14 (cast 64 false (var _dec))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
+a "dec r15" 49ffcf 0x0 (seq (set _op (var r15)) (set _dec (- (var _op) (bv 64 0x1))) (set r15 (cast 64 false (var _dec))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
+a "dec r15d" 41ffcf 0x0 (seq (set _op (cast 32 false (var r15))) (set _dec (- (var _op) (bv 32 0x1))) (set r15 (cast 64 false (var _dec))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
+a "dec r8" 49ffc8 0x0 (seq (set _op (var r8)) (set _dec (- (var _op) (bv 64 0x1))) (set r8 (cast 64 false (var _dec))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
+a "dec r8d" 41ffc8 0x0 (seq (set _op (cast 32 false (var r8))) (set _dec (- (var _op) (bv 32 0x1))) (set r8 (cast 64 false (var _dec))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
+a "dec r9" 49ffc9 0x0 (seq (set _op (var r9)) (set _dec (- (var _op) (bv 64 0x1))) (set r9 (cast 64 false (var _dec))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
+a "dec r9d" 41ffc9 0x0 (seq (set _op (cast 32 false (var r9))) (set _dec (- (var _op) (bv 32 0x1))) (set r9 (cast 64 false (var _dec))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
 a "dec rax" 48ffc8 0x0 (seq (set _op (var rax)) (set _dec (- (var _op) (bv 64 0x1))) (set rax (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
 a "dec rbp" 48ffcd 0x0 (seq (set _op (var rbp)) (set _dec (- (var _op) (bv 64 0x1))) (set rbp (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
 a "dec rbx" 48ffcb 0x0 (seq (set _op (var rbx)) (set _dec (- (var _op) (bv 64 0x1))) (set rbx (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (! (is_zero (var _val))) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))))
@@ -1004,22 +1004,22 @@ a "bswap r15d" 410fcf
 ad "endbr64" f30f1efa
 d "enter 8, 0" c8080000 0x0 (seq (set _alloc_sz (cast 16 false (bv 64 0x8))) (set _nest_lvl (mod (cast 8 false (bv 64 0x0)) (bv 8 0x20))) (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (var rbp))) (set _frame_tmp (var rsp)) (branch (is_zero (var _nest_lvl)) nop (seq (branch (! (ule (var _nest_lvl) (bv 8 0x1))) (seq (set _itr (bv 8 0x1)) (repeat (&& (ule (var _itr) (var _nest_lvl)) (! (== (var _itr) (var _nest_lvl)))) (seq (set rbp (- (var rbp) (bv 64 0x8))) (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (loadw 0 64 (var rbp)))) (set _itr (+ (var _itr) (bv 8 0x1)))))) nop) (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (var _frame_tmp))))) (set rsp (- (var rsp) (cast 64 false (var _alloc_sz)))) (set rbp (var _frame_tmp)))
 d "enter 8, 0" 66c8080000 0x0 (seq (set _alloc_sz (cast 16 false (bv 32 0x8))) (set _nest_lvl (mod (cast 8 false (bv 32 0x0)) (bv 8 0x20))) (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (cast 32 false (var rbp)))) (set _frame_tmp (var rsp)) (branch (is_zero (var _nest_lvl)) nop (seq (branch (! (ule (var _nest_lvl) (bv 8 0x1))) (seq (set _itr (bv 8 0x1)) (repeat (&& (ule (var _itr) (var _nest_lvl)) (! (== (var _itr) (var _nest_lvl)))) (seq (set rbp (- (var rbp) (bv 64 0x4))) (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (loadw 0 32 (var rbp)))) (set _itr (+ (var _itr) (bv 8 0x1)))))) nop) (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (var _frame_tmp))))) (set rsp (- (var rsp) (cast 64 false (var _alloc_sz)))) (set rbp (| (& (var rbp) (~ (bv 64 0xffffffff))) (cast 64 false (var _frame_tmp)))))
-ad "xchg eax, r8d" 4190 0x0 (seq (set _temp (cast 32 false (var rax))) (set rax (| (& (var rax) (~ (bv 64 0xffffffff))) (cast 64 false (cast 32 false (var r8))))) (set r8 (| (& (var r8) (~ (bv 64 0xffffffff))) (cast 64 false (var _temp)))))
-a "xchg r8d, eax" 4190 0x0 (seq (set _temp (cast 32 false (var rax))) (set rax (| (& (var rax) (~ (bv 64 0xffffffff))) (cast 64 false (cast 32 false (var r8))))) (set r8 (| (& (var r8) (~ (bv 64 0xffffffff))) (cast 64 false (var _temp)))))
+ad "xchg eax, r8d" 4190 0x0 (seq (set _temp (cast 32 false (var rax))) (set rax (| (& (var rax) (~ (bv 64 0xffffffff))) (cast 64 false (cast 32 false (var r8))))) (set r8 (cast 64 false (var _temp))))
+a "xchg r8d, eax" 4190 0x0 (seq (set _temp (cast 32 false (var rax))) (set rax (| (& (var rax) (~ (bv 64 0xffffffff))) (cast 64 false (cast 32 false (var r8))))) (set r8 (cast 64 false (var _temp))))
 ad "xchg rax, rdx" 4892 0x0 (seq (set _temp (var rax)) (set rax (var rdx)) (set rdx (var _temp)))
 a "xchg rdx, rax" 4892 0x0 (seq (set _temp (var rax)) (set rax (var rdx)) (set rdx (var _temp)))
-ad "xchg rax, r8" 4990 0x0 (seq (set _temp (var rax)) (set rax (var r8)) (set r8 (var _temp)))
-a "xchg r8, rax" 4990 0x0 (seq (set _temp (var rax)) (set rax (var r8)) (set r8 (var _temp)))
+ad "xchg rax, r8" 4990 0x0 (seq (set _temp (var rax)) (set rax (var r8)) (set r8 (cast 64 false (var _temp))))
+a "xchg r8, rax" 4990 0x0 (seq (set _temp (var rax)) (set rax (var r8)) (set r8 (cast 64 false (var _temp))))
 ad "xchg rdx, rbx" 4887da 0x0 (seq (set _temp (var rdx)) (set rdx (var rbx)) (set rbx (var _temp)))
 ad "xchg rbx, rdx" 4887d3 0x0 (seq (set _temp (var rbx)) (set rbx (var rdx)) (set rdx (var _temp)))
-ad "xchg r8, r15" 4d87f8 0x0 (seq (set _temp (var r8)) (set r8 (var r15)) (set r15 (var _temp)))
-ad "xchg r15, r8" 4d87c7 0x0 (seq (set _temp (var r15)) (set r15 (var r8)) (set r8 (var _temp)))
-ad "xchg r8d, r15d" 4587f8 0x0 (seq (set _temp (cast 32 false (var r8))) (set r8 (| (& (var r8) (~ (bv 64 0xffffffff))) (cast 64 false (cast 32 false (var r15))))) (set r15 (| (& (var r15) (~ (bv 64 0xffffffff))) (cast 64 false (var _temp)))))
-ad "xchg r15d, r8d" 4587c7 0x0 (seq (set _temp (cast 32 false (var r15))) (set r15 (| (& (var r15) (~ (bv 64 0xffffffff))) (cast 64 false (cast 32 false (var r8))))) (set r8 (| (& (var r8) (~ (bv 64 0xffffffff))) (cast 64 false (var _temp)))))
-ad "xchg rdx, r8" 4c87c2 0x0 (seq (set _temp (var rdx)) (set rdx (var r8)) (set r8 (var _temp)))
-ad "xchg r15, rdx" 4987d7 0x0 (seq (set _temp (var r15)) (set r15 (var rdx)) (set rdx (var _temp)))
-d "call qword [rip + 0x3a8f3e]" 48ff153e8f3a00 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0))))
-d "call qword [rip + 0x1d638f]" 48ff158f631d00 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0))))
+ad "xchg r8, r15" 4d87f8 0x0 (seq (set _temp (var r8)) (set r8 (cast 64 false (var r15))) (set r15 (cast 64 false (var _temp))))
+ad "xchg r15, r8" 4d87c7 0x0 (seq (set _temp (var r15)) (set r15 (cast 64 false (var r8))) (set r8 (cast 64 false (var _temp))))
+ad "xchg r8d, r15d" 4587f8 0x0 (seq (set _temp (cast 32 false (var r8))) (set r8 (cast 64 false (cast 32 false (var r15)))) (set r15 (cast 64 false (var _temp))))
+ad "xchg r15d, r8d" 4587c7 0x0 (seq (set _temp (cast 32 false (var r15))) (set r15 (cast 64 false (cast 32 false (var r8)))) (set r8 (cast 64 false (var _temp))))
+ad "xchg rdx, r8" 4c87c2 0x0 (seq (set _temp (var rdx)) (set rdx (var r8)) (set r8 (cast 64 false (var _temp))))
+ad "xchg r15, rdx" 4987d7 0x0 (seq (set _temp (var r15)) (set r15 (cast 64 false (var rdx))) (set rdx (var _temp)))
+d "call qword [rip + 0x3a8f3e]" 48ff153e8f3a00 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (bv 64 0x7))) (jmp (loadw 0 64 (+ (bv 64 0x7) (bv 64 0x3a8f3e)))))
+d "call qword [rip + 0x1d638f]" 48ff158f631d00 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (bv 64 0x7))) (jmp (loadw 0 64 (+ (bv 64 0x7) (bv 64 0x1d638f)))))
 a "fmul st2, st0" dcca
 a "fdiv st0, st1" d8f1
 a "fdiv st(0), st(1)" d8f1