diff --git a/librz/analysis/arch/x86/x86_il.c b/librz/analysis/arch/x86/x86_il.c new file mode 100644 index 0000000000..fafcb5d7c8 --- /dev/null +++ b/librz/analysis/arch/x86/x86_il.c @@ -0,0 +1,3831 @@ +// SPDX-FileCopyrightText: 2022 Dhruv Maroo +// SPDX-License-Identifier: LGPL-3.0-only + +/** + * \file x86_il.c + * + * Converts x86 instructions to RzIL instructions + * + * References: + * - https://www.intel.com/content/www/us/en/developer/articles/technical/intel-sdm.html + */ + +#include "x86_il.h" +#include + +#define X86_BIT(x) UN(1, x) +#define X86_TO32(x) UNSIGNED(32, x) + +#define IL_LIFTER(mnem) static RzILOpEffect *x86_il_##mnem(const X86ILIns *ins, ut64 pc, RzAnalysis *analysis) + +/** + * \brief x86 registers + */ +static const char *x86_registers[] = { + [X86_REG_AH] = "ah", + [X86_REG_AL] = "al", + [X86_REG_AX] = "ax", + [X86_REG_BH] = "bh", + [X86_REG_BL] = "bl", + [X86_REG_BP] = "bp", + [X86_REG_BPL] = "bpl", + [X86_REG_BX] = "bx", + [X86_REG_CH] = "ch", + [X86_REG_CL] = "cl", + [X86_REG_CS] = "cs", + [X86_REG_CX] = "cx", + [X86_REG_DH] = "dh", + [X86_REG_DI] = "di", + [X86_REG_DIL] = "dil", + [X86_REG_DL] = "dl", + [X86_REG_DS] = "ds", + [X86_REG_DX] = "dx", + [X86_REG_EAX] = "eax", + [X86_REG_EBP] = "ebp", + [X86_REG_EBX] = "ebx", + [X86_REG_ECX] = "ecx", + [X86_REG_EDI] = "edi", + [X86_REG_EDX] = "edx", + [X86_REG_EFLAGS] = "eflags", + [X86_REG_EIP] = "eip", + [X86_REG_EIZ] = "eiz", + [X86_REG_ES] = "es", + [X86_REG_ESI] = "esi", + [X86_REG_ESP] = "esp", + [X86_REG_FPSW] = "fpsw", + [X86_REG_FS] = "fs", + [X86_REG_GS] = "gs", + [X86_REG_IP] = "ip", + [X86_REG_RAX] = "rax", + [X86_REG_RBP] = "rbp", + [X86_REG_RBX] = "rbx", + [X86_REG_RCX] = "rcx", + [X86_REG_RDI] = "rdi", + [X86_REG_RDX] = "rdx", + [X86_REG_RIP] = "rip", + [X86_REG_RIZ] = "riz", + [X86_REG_RSI] = "rsi", + [X86_REG_RSP] = "rsp", + [X86_REG_SI] = "si", + [X86_REG_SIL] = "sil", + [X86_REG_SP] = "sp", + [X86_REG_SPL] = "spl", + [X86_REG_SS] = "ss", + [X86_REG_CR0] = "cr0", + [X86_REG_CR1] = "cr1", + [X86_REG_CR2] = "cr2", + [X86_REG_CR3] = "cr3", + [X86_REG_CR4] = "cr4", + [X86_REG_CR5] = "cr5", + [X86_REG_CR6] = "cr6", + [X86_REG_CR7] = "cr7", + [X86_REG_CR8] = "cr8", + [X86_REG_CR9] = "cr9", + [X86_REG_CR10] = "cr10", + [X86_REG_CR11] = "cr11", + [X86_REG_CR12] = "cr12", + [X86_REG_CR13] = "cr13", + [X86_REG_CR14] = "cr14", + [X86_REG_CR15] = "cr15", + [X86_REG_DR0] = "dr0", + [X86_REG_DR1] = "dr1", + [X86_REG_DR2] = "dr2", + [X86_REG_DR3] = "dr3", + [X86_REG_DR4] = "dr4", + [X86_REG_DR5] = "dr5", + [X86_REG_DR6] = "dr6", + [X86_REG_DR7] = "dr7", + [X86_REG_DR8] = "dr8", + [X86_REG_DR9] = "dr9", + [X86_REG_DR10] = "dr10", + [X86_REG_DR11] = "dr11", + [X86_REG_DR12] = "dr12", + [X86_REG_DR13] = "dr13", + [X86_REG_DR14] = "dr14", + [X86_REG_DR15] = "dr15", + [X86_REG_FP0] = "fp0", + [X86_REG_FP1] = "fp1", + [X86_REG_FP2] = "fp2", + [X86_REG_FP3] = "fp3", + [X86_REG_FP4] = "fp4", + [X86_REG_FP5] = "fp5", + [X86_REG_FP6] = "fp6", + [X86_REG_FP7] = "fp7", + [X86_REG_K0] = "k0", + [X86_REG_K1] = "k1", + [X86_REG_K2] = "k2", + [X86_REG_K3] = "k3", + [X86_REG_K4] = "k4", + [X86_REG_K5] = "k5", + [X86_REG_K6] = "k6", + [X86_REG_K7] = "k7", + [X86_REG_MM0] = "mm0", + [X86_REG_MM1] = "mm1", + [X86_REG_MM2] = "mm2", + [X86_REG_MM3] = "mm3", + [X86_REG_MM4] = "mm4", + [X86_REG_MM5] = "mm5", + [X86_REG_MM6] = "mm6", + [X86_REG_MM7] = "mm7", + [X86_REG_R8] = "r8", + [X86_REG_R9] = "r9", + [X86_REG_R10] = "r10", + [X86_REG_R11] = "r11", + [X86_REG_R12] = "r12", + [X86_REG_R13] = "r13", + [X86_REG_R14] = "r14", + [X86_REG_R15] = "r15", + [X86_REG_ST0] = "st0", + [X86_REG_ST1] = "st1", + [X86_REG_ST2] = "st2", + [X86_REG_ST3] = "st3", + [X86_REG_ST4] = "st4", + [X86_REG_ST5] = "st5", + [X86_REG_ST6] = "st6", + [X86_REG_ST7] = "st7", + [X86_REG_XMM0] = "xmm0", + [X86_REG_XMM1] = "xmm1", + [X86_REG_XMM2] = "xmm2", + [X86_REG_XMM3] = "xmm3", + [X86_REG_XMM4] = "xmm4", + [X86_REG_XMM5] = "xmm5", + [X86_REG_XMM6] = "xmm6", + [X86_REG_XMM7] = "xmm7", + [X86_REG_XMM8] = "xmm8", + [X86_REG_XMM9] = "xmm9", + [X86_REG_XMM10] = "xmm10", + [X86_REG_XMM11] = "xmm11", + [X86_REG_XMM12] = "xmm12", + [X86_REG_XMM13] = "xmm13", + [X86_REG_XMM14] = "xmm14", + [X86_REG_XMM15] = "xmm15", + [X86_REG_XMM16] = "xmm16", + [X86_REG_XMM17] = "xmm17", + [X86_REG_XMM18] = "xmm18", + [X86_REG_XMM19] = "xmm19", + [X86_REG_XMM20] = "xmm20", + [X86_REG_XMM21] = "xmm21", + [X86_REG_XMM22] = "xmm22", + [X86_REG_XMM23] = "xmm23", + [X86_REG_XMM24] = "xmm24", + [X86_REG_XMM25] = "xmm25", + [X86_REG_XMM26] = "xmm26", + [X86_REG_XMM27] = "xmm27", + [X86_REG_XMM28] = "xmm28", + [X86_REG_XMM29] = "xmm29", + [X86_REG_XMM30] = "xmm30", + [X86_REG_XMM31] = "xmm31", + [X86_REG_YMM0] = "ymm0", + [X86_REG_YMM1] = "ymm1", + [X86_REG_YMM2] = "ymm2", + [X86_REG_YMM3] = "ymm3", + [X86_REG_YMM4] = "ymm4", + [X86_REG_YMM5] = "ymm5", + [X86_REG_YMM6] = "ymm6", + [X86_REG_YMM7] = "ymm7", + [X86_REG_YMM8] = "ymm8", + [X86_REG_YMM9] = "ymm9", + [X86_REG_YMM10] = "ymm10", + [X86_REG_YMM11] = "ymm11", + [X86_REG_YMM12] = "ymm12", + [X86_REG_YMM13] = "ymm13", + [X86_REG_YMM14] = "ymm14", + [X86_REG_YMM15] = "ymm15", + [X86_REG_YMM16] = "ymm16", + [X86_REG_YMM17] = "ymm17", + [X86_REG_YMM18] = "ymm18", + [X86_REG_YMM19] = "ymm19", + [X86_REG_YMM20] = "ymm20", + [X86_REG_YMM21] = "ymm21", + [X86_REG_YMM22] = "ymm22", + [X86_REG_YMM23] = "ymm23", + [X86_REG_YMM24] = "ymm24", + [X86_REG_YMM25] = "ymm25", + [X86_REG_YMM26] = "ymm26", + [X86_REG_YMM27] = "ymm27", + [X86_REG_YMM28] = "ymm28", + [X86_REG_YMM29] = "ymm29", + [X86_REG_YMM30] = "ymm30", + [X86_REG_YMM31] = "ymm31", + [X86_REG_ZMM0] = "zmm0", + [X86_REG_ZMM1] = "zmm1", + [X86_REG_ZMM2] = "zmm2", + [X86_REG_ZMM3] = "zmm3", + [X86_REG_ZMM4] = "zmm4", + [X86_REG_ZMM5] = "zmm5", + [X86_REG_ZMM6] = "zmm6", + [X86_REG_ZMM7] = "zmm7", + [X86_REG_ZMM8] = "zmm8", + [X86_REG_ZMM9] = "zmm9", + [X86_REG_ZMM10] = "zmm10", + [X86_REG_ZMM11] = "zmm11", + [X86_REG_ZMM12] = "zmm12", + [X86_REG_ZMM13] = "zmm13", + [X86_REG_ZMM14] = "zmm14", + [X86_REG_ZMM15] = "zmm15", + [X86_REG_ZMM16] = "zmm16", + [X86_REG_ZMM17] = "zmm17", + [X86_REG_ZMM18] = "zmm18", + [X86_REG_ZMM19] = "zmm19", + [X86_REG_ZMM20] = "zmm20", + [X86_REG_ZMM21] = "zmm21", + [X86_REG_ZMM22] = "zmm22", + [X86_REG_ZMM23] = "zmm23", + [X86_REG_ZMM24] = "zmm24", + [X86_REG_ZMM25] = "zmm25", + [X86_REG_ZMM26] = "zmm26", + [X86_REG_ZMM27] = "zmm27", + [X86_REG_ZMM28] = "zmm28", + [X86_REG_ZMM29] = "zmm29", + [X86_REG_ZMM30] = "zmm30", + [X86_REG_ZMM31] = "zmm31", + [X86_REG_R8B] = "r8b", + [X86_REG_R9B] = "r9b", + [X86_REG_R10B] = "r10b", + [X86_REG_R11B] = "r11b", + [X86_REG_R12B] = "r12b", + [X86_REG_R13B] = "r13b", + [X86_REG_R14B] = "r14b", + [X86_REG_R15B] = "r15b", + [X86_REG_R8D] = "r8d", + [X86_REG_R9D] = "r9d", + [X86_REG_R10D] = "r10d", + [X86_REG_R11D] = "r11d", + [X86_REG_R12D] = "r12d", + [X86_REG_R13D] = "r13d", + [X86_REG_R14D] = "r14d", + [X86_REG_R15D] = "r15d", + [X86_REG_R8W] = "r8w", + [X86_REG_R9W] = "r9w", + [X86_REG_R10W] = "r10w", + [X86_REG_R11W] = "r11w", + [X86_REG_R12W] = "r12w", + [X86_REG_R13W] = "r13w", + [X86_REG_R14W] = "r14w", + [X86_REG_R15W] = "r15w" +}; + +typedef enum x86_eflags_t { + X86_EFLAGS_CF = 0, + X86_EFLAGS_PF = 2, + X86_EFLAGS_AF = 4, + X86_EFLAGS_ZF = 6, + X86_EFLAGS_SF = 7, + X86_EFLAGS_TF = 8, + X86_EFLAGS_IF = 9, + X86_EFLAGS_DF = 10, + X86_EFLAGS_OF = 11, + X86_EFLAGS_IOPL = 12, + X86_EFLAGS_NT = 14, + X86_EFLAGS_RF = 16, + X86_EFLAGS_VM = 17, + X86_EFLAGS_AC = 18, + X86_EFLAGS_VIF = 19, + X86_EFLAGS_VIP = 20, + X86_EFLAGS_ID = 21 +} X86EFlags; + +static const char *x86_eflags_registers[] = { + [X86_EFLAGS_CF] = "cf", + [X86_EFLAGS_PF] = "pf", + [X86_EFLAGS_AF] = "af", + [X86_EFLAGS_ZF] = "zf", + [X86_EFLAGS_SF] = "sf", + [X86_EFLAGS_TF] = "tf", + [X86_EFLAGS_IF] = "if", + [X86_EFLAGS_DF] = "df", + [X86_EFLAGS_OF] = "of", + [X86_EFLAGS_NT] = "nt", + [X86_EFLAGS_RF] = "rf", + [X86_EFLAGS_VM] = "vm", + [X86_EFLAGS_AC] = "ac" +}; + +#define EFLAGS(f) x86_eflags_registers[X86_EFLAGS_##f] + +#define COMMON_REGS \ + "cs", /* X86_REG_CS */ \ + "ss", /* X86_REG_SS */ \ + "ds", /* X86_REG_DS */ \ + "es", /* X86_REG_ES */ \ + "cf", /* X86_EFLAGS_CF */ \ + "pf", /* X86_EFLAGS_PF */ \ + "af", /* X86_EFLAGS_AF */ \ + "zf", /* X86_EFLAGS_ZF */ \ + "sf", /* X86_EFLAGS_SF */ \ + "tf", /* X86_EFLAGS_TF */ \ + "if", /* X86_EFLAGS_IF */ \ + "df", /* X86_EFLAGS_DF */ \ + "of", /* X86_EFLAGS_OF */ \ + "nt" /* X86_EFLAGS_NT */ + +/** + * \brief All registers bound to IL variables for x86 16-bit + */ +static const char *x86_bound_regs_16[] = { + COMMON_REGS, + "ax", /* X86_REG_AX */ + "bx", /* X86_REG_BX */ + "cx", /* X86_REG_CX */ + "dx", /* X86_REG_DX */ + "ip", /* X86_REG_IP */ + "sp", /* X86_REG_SP */ + "bp", /* X86_REG_BP */ + "si", /* X86_REG_SI */ + "di", /* X86_REG_DI */ + NULL +}; + +/** + * \brief All registers bound to IL variables for x86 32-bit + */ +static const char *x86_bound_regs_32[] = { + COMMON_REGS, + "eax", /* X86_REG_EAX */ + "ebx", /* X86_REG_EBX */ + "ecx", /* X86_REG_ECX */ + "edx", /* X86_REG_EDX */ + "eip", /* X86_REG_EIP */ + "esp", /* X86_REG_ESP */ + "ebp", /* X86_REG_EBP */ + "esi", /* X86_REG_ESI */ + "edi", /* X86_REG_EDI */ + "rf", /* X86_EFLAGS_RF */ + "vm", /* X86_EFLAGS_VM */ + "ac", /* X86_EFLAGS_AC */ + "fs", /* X86_REG_FS */ + "gs", /* X86_REG_GS */ + "cr0", /* X86_REG_CR0 */ + "dr0", /* X86_REG_DR0 */ + NULL +}; + +/** + * \brief All registers bound to IL variables for x86 64-bit + */ +static const char *x86_bound_regs_64[] = { + COMMON_REGS, + "rax", /* X86_REG_RAX */ + "rbx", /* X86_REG_RBX */ + "rcx", /* X86_REG_RCX */ + "rdx", /* X86_REG_RDX */ + "rip", /* X86_REG_RIP */ + "rsp", /* X86_REG_RSP */ + "rbp", /* X86_REG_RBP */ + "rsi", /* X86_REG_RSI */ + "rdi", /* X86_REG_RDI */ + "r8", /* X86_REG_R8 */ + "r9", /* X86_REG_R9 */ + "r10", /* X86_REG_R10 */ + "r11", /* X86_REG_R11 */ + "r12", /* X86_REG_R12 */ + "r13", /* X86_REG_R13 */ + "r14", /* X86_REG_R14 */ + "r15", /* X86_REG_R15 */ + "rf", /* X86_EFLAGS_RF */ + "vm", /* X86_EFLAGS_VM */ + "ac", /* X86_EFLAGS_AC */ + "fs", /* X86_REG_FS */ + "gs", /* X86_REG_GS */ + "cr0", /* X86_REG_CR0 */ + "dr0", /* X86_REG_DR0 */ + NULL +}; + +static const X86Reg gpr_hregs[] = { + X86_REG_AH, // rax + X86_REG_BH, // rbx + X86_REG_CH, // rcx + X86_REG_DH, // rdx + X86_REG_INVALID, // rbp + X86_REG_INVALID, // rdi + X86_REG_INVALID, // rip + X86_REG_INVALID, // riz + X86_REG_INVALID, // rsi + X86_REG_INVALID // rsp +}; + +static const X86Reg gpr_lregs[] = { + X86_REG_AL, // rax + X86_REG_BL, // rbx + X86_REG_CL, // rcx + X86_REG_DL, // rdx + X86_REG_BPL, // rbp + X86_REG_DIL, // rdi + X86_REG_INVALID, // rip + X86_REG_INVALID, // riz + X86_REG_SIL, // rsi + X86_REG_SPL, // rsp +}; + +static const X86Reg gpr_xregs[] = { + X86_REG_AX, // rax + X86_REG_BX, // rbx + X86_REG_CX, // rcx + X86_REG_DX, // rdx + X86_REG_BP, // rbp + X86_REG_DI, // rdi + X86_REG_IP, // rip + X86_REG_INVALID, // riz + X86_REG_SI, // rsi + X86_REG_SP, // rsp +}; + +static const X86Reg gpr_eregs[] = { + X86_REG_EAX, // rax + X86_REG_EBX, // rbx + X86_REG_ECX, // rcx + X86_REG_EDX, // rdx + X86_REG_EBP, // rbp + X86_REG_EDI, // rdi + X86_REG_EIP, // rip + X86_REG_EIZ, // riz + X86_REG_ESI, // rsi + X86_REG_ESP, // rsp +}; + +static const X86Reg gpr_rregs[] = { + X86_REG_RAX, + X86_REG_RBX, + X86_REG_RCX, + X86_REG_RDX, + X86_REG_RBP, + X86_REG_RDI, + X86_REG_RIP, + X86_REG_RIZ, + X86_REG_RSI, + X86_REG_RSP +}; + +/** + * \brief Check if \p reg is a general purpose register (this term is quite loosely used here) + * + * \param reg + */ +static bool x86_il_is_gpr(X86Reg reg) { + for (unsigned int i = 0; i < GPR_FAMILY_COUNT; i++) { + if (reg == gpr_hregs[i] || reg == gpr_lregs[i] || reg == gpr_xregs[i] || reg == gpr_eregs[i] || reg == gpr_rregs[i]) { + return true; + } + } + + return false; +} + +/** + * \brief Get size of \p reg + * + * \param reg + */ +static ut8 x86_il_get_reg_size(X86Reg reg) { + for (unsigned int i = 0; i < GPR_FAMILY_COUNT; i++) { + if (reg == gpr_hregs[i] || reg == gpr_lregs[i]) { + return 8; + } else if (reg == gpr_xregs[i]) { + return 16; + } else if (reg == gpr_eregs[i]) { + return 32; + } else if (reg == gpr_rregs[i]) { + return 64; + } + } + + return 0; +} + +/** + * \brief Get the higher 8 bits (8-16) of register \p reg + * + * \param reg + * \param bits bitness + */ +static RzILOpPure *x86_il_get_gprh(X86Reg reg, int bits) { + return UNSIGNED(8, SHIFTR0(VARG(x86_registers[reg]), U8(8))); +} +/** + * \brief Get the lower 8 bits (0-8) of register \p reg + * + * \param reg + * \param bits bitness + */ +static RzILOpPure *x86_il_get_gprl(X86Reg reg, int bits) { + return UNSIGNED(8, VARG(x86_registers[reg])); +} +/** + * \brief Get the lower 16 bits (0-16) of register \p reg + * + * \param reg + * \param bits bitness + */ +static RzILOpPure *x86_il_get_gpr16(X86Reg reg, int bits) { + if (bits == 16) { + // Don't perform unnecessary casting + return VARG(x86_registers[reg]); + } + return UNSIGNED(16, VARG(x86_registers[reg])); +} +/** + * \brief Get the lower 32 bits (0-32) of register \p reg + * + * \param reg + * \param bits bitness + */ +static RzILOpPure *x86_il_get_gpr32(X86Reg reg, int bits) { + if (bits == 32) { + return VARG(x86_registers[reg]); + } + return UNSIGNED(32, VARG(x86_registers[reg])); +} +/** + * \brief Get 64 bits (0-64) of register \p reg + * + * \param reg + * \param bits bitness + */ +static RzILOpPure *x86_il_get_gpr64(X86Reg reg, int bits) { + return VARG(x86_registers[reg]); +} + +/** + * \brief Set the higher 8 bits (8-16) of register \p reg to \p val + * + * \param reg + * \param val + * \param bits bitness + */ +static RzILOpEffect *x86_il_set_gprh(X86Reg reg, RZ_OWN RzILOpPure *val, int bits) { + RzILOpPure *mask = LOGNOT(UN(bits, 0xff00)); + RzILOpPure *masked_reg = LOGAND(VARG(x86_registers[reg]), mask); + RzILOpPure *final_reg = LOGOR(masked_reg, SHIFTL0(UNSIGNED(bits, val), U8(8))); + return SETG(x86_registers[reg], final_reg); +} +/** + * \brief Set the lower 8 bits (0-8) of register \p reg to \p val + * + * \param reg + * \param val + * \param bits bitness + */ +static RzILOpEffect *x86_il_set_gprl(X86Reg reg, RZ_OWN RzILOpPure *val, int bits) { + RzILOpPure *mask = LOGNOT(UN(bits, 0xff)); + RzILOpPure *masked_reg = LOGAND(VARG(x86_registers[reg]), mask); + RzILOpPure *final_reg = LOGOR(masked_reg, UNSIGNED(bits, val)); + return SETG(x86_registers[reg], final_reg); +} +/** + * \brief Set the lower 16 bits (0-16) of register \p reg to \p val + * + * \param reg + * \param val + * \param bits bitness + */ +static RzILOpEffect *x86_il_set_gpr16(X86Reg reg, RZ_OWN RzILOpPure *val, int bits) { + if (bits == 16) { + // Don't perform unnecessary casting + return SETG(x86_registers[reg], val); + } + RzILOpPure *mask = LOGNOT(UN(bits, 0xffff)); + RzILOpPure *masked_reg = LOGAND(VARG(x86_registers[reg]), mask); + RzILOpPure *final_reg = LOGOR(masked_reg, UNSIGNED(bits, val)); + return SETG(x86_registers[reg], final_reg); +} +/** + * \brief Set the lower 32 bits (0-32) of register \p reg to \p val + * + * \param reg + * \param val + * \param bits bitness + */ +static RzILOpEffect *x86_il_set_gpr32(X86Reg reg, RZ_OWN RzILOpPure *val, int bits) { + if (bits == 32) { + return SETG(x86_registers[reg], val); + } + RzILOpPure *mask = LOGNOT(UN(bits, 0xffffffff)); + RzILOpPure *masked_reg = LOGAND(VARG(x86_registers[reg]), mask); + RzILOpPure *final_reg = LOGOR(masked_reg, UNSIGNED(bits, val)); + return SETG(x86_registers[reg], final_reg); +} +/** + * \brief Set 64 bits (0-64) of register \p reg to \p val + * + * \param reg + * \param val + * \param bits bitness + */ +static RzILOpEffect *x86_il_set_gpr64(X86Reg reg, RzILOpPure *val, int bits) { + return SETG(x86_registers[reg], val); +} + +/** + * \brief Get the widest register corresponding to index \p index and bitness \p bits + * + * \param index + * \param bits + */ +static X86Reg get_bitness_reg(unsigned int index, int bits) { + if (index >= GPR_FAMILY_COUNT) { + return X86_REG_INVALID; + } + if (bits == 16) { + return gpr_xregs[index]; + } else if (bits == 32) { + return gpr_eregs[index]; + } else { + return gpr_rregs[index]; + } +} + +struct gpr_lookup_helper_t { + unsigned int index; ///< register index + RzILOpPure *(*get_handler)(X86Reg, int); ///< getter + RzILOpEffect *(*set_handler)(X86Reg, RzILOpPure *, int); ///< setter +}; + +static const struct gpr_lookup_helper_t gpr_lookup_table[] = { + [X86_REG_AH] = { 0, x86_il_get_gprh, x86_il_set_gprh }, + [X86_REG_AL] = { 0, x86_il_get_gprl, x86_il_set_gprl }, + [X86_REG_AX] = { 0, x86_il_get_gpr16, x86_il_set_gpr16 }, + [X86_REG_EAX] = { 0, x86_il_get_gpr32, x86_il_set_gpr32 }, + [X86_REG_RAX] = { 0, x86_il_get_gpr64, x86_il_set_gpr64 }, + [X86_REG_BH] = { 1, x86_il_get_gprh, x86_il_set_gprh }, + [X86_REG_BL] = { 1, x86_il_get_gprl, x86_il_set_gprl }, + [X86_REG_BX] = { 1, x86_il_get_gpr16, x86_il_set_gpr16 }, + [X86_REG_EBX] = { 1, x86_il_get_gpr32, x86_il_set_gpr32 }, + [X86_REG_RBX] = { 1, x86_il_get_gpr64, x86_il_set_gpr64 }, + [X86_REG_CH] = { 2, x86_il_get_gprh, x86_il_set_gprh }, + [X86_REG_CL] = { 2, x86_il_get_gprl, x86_il_set_gprl }, + [X86_REG_CX] = { 2, x86_il_get_gpr16, x86_il_set_gpr16 }, + [X86_REG_ECX] = { 2, x86_il_get_gpr32, x86_il_set_gpr32 }, + [X86_REG_RCX] = { 2, x86_il_get_gpr64, x86_il_set_gpr64 }, + [X86_REG_DH] = { 3, x86_il_get_gprh, x86_il_set_gprh }, + [X86_REG_DL] = { 3, x86_il_get_gprl, x86_il_set_gprl }, + [X86_REG_DX] = { 3, x86_il_get_gpr16, x86_il_set_gpr16 }, + [X86_REG_EDX] = { 3, x86_il_get_gpr32, x86_il_set_gpr32 }, + [X86_REG_RDX] = { 3, x86_il_get_gpr64, x86_il_set_gpr64 }, + [X86_REG_BPL] = { 4, x86_il_get_gprl, x86_il_set_gprl }, + [X86_REG_BP] = { 4, x86_il_get_gpr16, x86_il_set_gpr16 }, + [X86_REG_EBP] = { 4, x86_il_get_gpr32, x86_il_set_gpr32 }, + [X86_REG_RBP] = { 4, x86_il_get_gpr64, x86_il_set_gpr64 }, + [X86_REG_DIL] = { 5, x86_il_get_gprl, x86_il_set_gprl }, + [X86_REG_DI] = { 5, x86_il_get_gpr16, x86_il_set_gpr16 }, + [X86_REG_EDI] = { 5, x86_il_get_gpr32, x86_il_set_gpr32 }, + [X86_REG_RDI] = { 5, x86_il_get_gpr64, x86_il_set_gpr64 }, + [X86_REG_EIZ] = { 7, x86_il_get_gpr32, x86_il_set_gpr32 }, + [X86_REG_RIZ] = { 7, x86_il_get_gpr64, x86_il_set_gpr64 }, + [X86_REG_SIL] = { 8, x86_il_get_gprl, x86_il_set_gprl }, + [X86_REG_SI] = { 8, x86_il_get_gpr16, x86_il_set_gpr16 }, + [X86_REG_ESI] = { 8, x86_il_get_gpr32, x86_il_set_gpr32 }, + [X86_REG_RSI] = { 8, x86_il_get_gpr64, x86_il_set_gpr64 }, + [X86_REG_SPL] = { 9, x86_il_get_gprl, x86_il_set_gprl }, + [X86_REG_SP] = { 9, x86_il_get_gpr16, x86_il_set_gpr16 }, + [X86_REG_ESP] = { 9, x86_il_get_gpr32, x86_il_set_gpr32 }, + [X86_REG_RSP] = { 9, x86_il_get_gpr64, x86_il_set_gpr64 } +}; + +/** + * \brief Check if the register \p reg is an instruction pointer register + * + * \param reg + */ +bool is_pc_reg(X86Reg reg) { + return (reg == X86_REG_IP || reg == X86_REG_EIP || reg == X86_REG_RIP); +} + +struct extreg_lookup_helper_t { + X86Reg curr_reg; ///< register being used + X86Reg base_reg; ///< base register for `curr_reg` + RzILOpPure *(*get_handler)(X86Reg, int); ///< getter + RzILOpEffect *(*set_handler)(X86Reg, RzILOpPure *, int); ///< setter +}; + +#define extreg_lookup(suff, getter, setter) \ + { X86_REG_R8##suff, X86_REG_R8, getter, setter }, \ + { X86_REG_R9##suff, X86_REG_R9, getter, setter }, \ + { X86_REG_R10##suff, X86_REG_R10, getter, setter }, \ + { X86_REG_R11##suff, X86_REG_R11, getter, setter }, \ + { X86_REG_R12##suff, X86_REG_R12, getter, setter }, \ + { X86_REG_R13##suff, X86_REG_R13, getter, setter }, \ + { X86_REG_R14##suff, X86_REG_R14, getter, setter }, \ + { X86_REG_R15##suff, X86_REG_R15, getter, setter }, + +static const struct extreg_lookup_helper_t extreg_lookup_table[] = { + // 64-bit wide + extreg_lookup(, x86_il_get_gpr64, x86_il_set_gpr64) + + // 8-bit wide (byte) + extreg_lookup(B, x86_il_get_gprl, x86_il_set_gprl) + + // 16-bit wide (word) + extreg_lookup(W, x86_il_get_gpr16, x86_il_set_gpr16) + + // 32-bit wide (dword) + extreg_lookup(D, x86_il_get_gpr32, x86_il_set_gpr32) +}; + +/** + * \brief Get the index for external register \p reg + * + * \param reg + */ +int get_extreg_ind(X86Reg reg) { + for (unsigned int i = 0; i < 8 * 4 /* size of extreg_lookup_table */; i++) { + if (extreg_lookup_table[i].curr_reg == reg) { + return i; + } + } + + return -1; +} + +/** + * \brief Get the value of a register \p reg, in a "smart" way + * Just use the `x86_il_get_reg` macro whenever you need to get the + * value of a register. This function will take care of all the casting + * and extracting of (smaller) registers. + * + * \param reg + * \param bits bitness + * \param pc Program counter + */ +static RzILOpPure *x86_il_get_reg_bits(X86Reg reg, int bits, uint64_t pc) { + if (is_pc_reg(reg)) { + return UN(bits, pc); + } + + int ind = -1; + + if (x86_il_is_gpr(reg)) { + struct gpr_lookup_helper_t entry = gpr_lookup_table[reg]; + /* Need to use `get_bitness_reg` because not all registers + are available in the IL in any particular bitness + (For example, "rax" is not a valid IL variable in 32-bit mode) + So, we need to use the max width register available */ + return entry.get_handler(get_bitness_reg(entry.index, bits), bits); + } else if ((ind = get_extreg_ind(reg)) != -1 && bits == 64) { + struct extreg_lookup_helper_t entry = extreg_lookup_table[ind]; + return entry.get_handler(entry.base_reg, bits); + } + + return VARG(x86_registers[reg]); +} + +#define x86_il_get_reg(reg) x86_il_get_reg_bits(reg, analysis->bits, pc) + +/** + * \brief Set the value of a register \p reg, in a "smart" way + * Just use the `x86_il_set_reg` macro whenever you need to set the + * value of a register. This function will take care of all the casting + * and storing and compositing values in case of (smaller) registers. + * + * \param reg + * \param val Value to be stored + * \param bits bitness + */ +static RzILOpEffect *x86_il_set_reg_bits(X86Reg reg, RzILOpPure *val, int bits) { + int ind = -1; + + if (x86_il_is_gpr(reg)) { + struct gpr_lookup_helper_t entry = gpr_lookup_table[reg]; + return entry.set_handler(get_bitness_reg(entry.index, bits), val, bits); + } else if ((ind = get_extreg_ind(reg)) != -1 && bits == 64) { + struct extreg_lookup_helper_t entry = extreg_lookup_table[ind]; + return entry.set_handler(entry.base_reg, val, bits); + } + + return SETG(x86_registers[reg], val); +} + +#define x86_il_set_reg(reg, val) x86_il_set_reg_bits(reg, val, analysis->bits) + +/** + * \brief Get the memory address as an `RzILOpPure` from X86Mem \p mem + * You can also optionally provide a custom segment register as \p segment + * This function takes care of all casting and conversion + * This has partial segmentation support as of now + * + * You probably wouldn't need to use it directly, consider using the wrappers + * `x86_il_get_memaddr` and `x86_il_set_memaddr` + * + * \param mem + * \param segment + * \param bits bitness + */ +static RzILOpPure *x86_il_get_memaddr_segment_bits(X86Mem mem, X86Reg segment, int bits) { + RzILOpPure *offset = NULL; + if (mem.base != X86_REG_INVALID && !offset) { + offset = x86_il_get_reg_bits(mem.base, bits, 0); + if (x86_il_get_reg_size(mem.base) != bits) { + offset = UNSIGNED(bits, offset); + } + } + if (mem.index != X86_REG_INVALID) { + RzILOpPure *reg = x86_il_get_reg_bits(mem.index, bits, 0); + if (x86_il_get_reg_size(mem.index) != bits) { + reg = UNSIGNED(bits, reg); + } + if (!offset) { + offset = MUL(reg, UN(bits, mem.scale)); + } else { + offset = ADD(offset, MUL(reg, UN(bits, mem.scale))); + } + } + if (!offset) { + offset = UN(bits, mem.disp); + } else { + offset = ADD(offset, UN(bits, mem.disp)); + } + + /* Segmentation not present in x86-64 */ + if (bits != 64 && segment != X86_REG_INVALID) { + // TODO: Implement segmentation + /* Currently the segmentation is only implemented for real mode + Address = Segment * 0x10 + Offset */ + + /* Assuming real mode */ + offset = ADD(offset, SHIFTL0(UNSIGNED(bits, x86_il_get_reg_bits(segment, bits, 0)), U8(4))); + } + + return offset; +} + +#define x86_il_get_memaddr_segment(mem, segment) x86_il_get_memaddr_segment_bits(mem, segment, analysis->bits) + +static RzILOpPure *x86_il_get_memaddr_bits(X86Mem mem, int bits) { + return x86_il_get_memaddr_segment_bits(mem, mem.segment, bits); +} + +#define x86_il_get_memaddr(mem) x86_il_get_memaddr_bits(mem, analysis->bits) + +static RzILOpEffect *x86_il_set_mem_bits(X86Mem mem, RzILOpPure *val, int bits) { + return STOREW(x86_il_get_memaddr_bits(mem, bits), val); +} + +#define x86_il_set_mem(mem, val) x86_il_set_mem_bits(mem, val, analysis->bits) + +/** + * \brief Get the value of the operand \p op + * This function takes care of everything, like choosing + * the correct type and returning the correct value + * Use the wrapper `x86_il_get_op` + * + * \param op + * \param analysis_bits bitness + */ +static RzILOpPure *x86_il_get_operand_bits(X86Op op, int analysis_bits) { + RzILOpPure *ret = NULL; + switch (op.type) { + case X86_OP_INVALID: + RZ_LOG_ERROR("x86: RzIL: Invalid param type encountered\n"); + break; + case X86_OP_REG: + ret = x86_il_get_reg_bits(op.reg, analysis_bits, 0); + break; + case X86_OP_IMM: + ret = SN(op.size * BITS_PER_BYTE, op.imm); + break; + case X86_OP_MEM: + ret = LOADW(BITS_PER_BYTE * op.size, x86_il_get_memaddr_bits(op.mem, analysis_bits)); + } + return ret; +} + +#define x86_il_get_operand(op) x86_il_get_operand_bits(op, analysis->bits) +#define x86_il_get_op(opnum) x86_il_get_operand_bits(ins->structure->operands[opnum], analysis->bits) + +/** + * \brief Get the value of the operand \p op + * This function takes care of everything, like choosing + * the correct type and setting the correct value + * Use the wrapper `x86_il_set_op` + * + * \param op + * \param analysis_bits bitness + */ +static RzILOpEffect *x86_il_set_operand_bits(X86Op op, RzILOpPure *val, int bits) { + RzILOpEffect *ret = NULL; + switch (op.type) { + case X86_OP_REG: + ret = x86_il_set_reg_bits(op.reg, val, bits); + break; + case X86_OP_MEM: + ret = x86_il_set_mem_bits(op.mem, val, bits); + break; + case X86_OP_IMM: + RZ_LOG_ERROR("x86: RzIL: Cannot set an immediate operand\n"); + break; + default: + RZ_LOG_ERROR("x86: RzIL: Invalid param type encountered\n"); + break; + } + return ret; +} + +#define x86_il_set_operand(op, val) x86_il_set_operand_bits(op, val, analysis->bits) +#define x86_il_set_op(opnum, val) x86_il_set_operand_bits(ins->structure->operands[opnum], val, analysis->bits) + +/** + * \brief Return the carry bit when \p x and \p y are added, with result \p res + * + * \param res + * \param x + * \param y + */ +static RzILOpBool *x86_il_is_add_carry(RZ_OWN RzILOpPure *res, RZ_OWN RzILOpPure *x, RZ_OWN RzILOpPure *y) { + // res = x + y + RzILOpBool *xmsb = MSB(x); + RzILOpBool *ymsb = MSB(y); + RzILOpBool *resmsb = MSB(res); + + // x & y + RzILOpBool *xy = AND(xmsb, ymsb); + RzILOpBool *nres = INV(resmsb); + + // !res & y + RzILOpBool *ry = AND(nres, DUP(ymsb)); + // x & !res + RzILOpBool *xr = AND(DUP(xmsb), DUP(nres)); + + // bit = xy | ry | xr + RzILOpBool * or = OR(xy, ry); + or = OR(or, xr); + + return or ; +} + +/** + * \brief Return the borrow bit when \p y is subtracted from \p x, with result \p res + * + * \param res + * \param x + * \param y + */ +static RzILOpBool *x86_il_is_sub_borrow(RZ_OWN RzILOpPure *res, RZ_OWN RzILOpPure *x, RZ_OWN RzILOpPure *y) { + // res = x - y + RzILOpBool *xmsb = MSB(x); + RzILOpBool *ymsb = MSB(y); + RzILOpBool *resmsb = MSB(res); + + // !x & y + RzILOpBool *nx = INV(xmsb); + RzILOpBool *nxy = AND(nx, ymsb); + + // y & res + RzILOpBool *rny = AND(DUP(ymsb), resmsb); + // res & !x + RzILOpBool *rnx = AND(DUP(resmsb), DUP(nx)); + + // bit = nxy | rny | rnx + RzILOpBool * or = OR(nxy, rny); + or = OR(or, rnx); + + return or ; +} + +/** + * \brief Return the overflow bit when \p x and \p y are added, with result \p res + * + * \param res + * \param x + * \param y + */ +static RzILOpBool *x86_il_is_add_overflow(RZ_OWN RzILOpPure *res, RZ_OWN RzILOpPure *x, RZ_OWN RzILOpPure *y) { + // res = x + y + RzILOpBool *xmsb = MSB(x); + RzILOpBool *ymsb = MSB(y); + RzILOpBool *resmsb = MSB(res); + + // !res & x & y + RzILOpBool *nrxy = AND(AND(INV(resmsb), xmsb), ymsb); + // res & !x & !y + RzILOpBool *rnxny = AND(AND(DUP(resmsb), INV(DUP(xmsb))), INV(DUP(ymsb))); + // or = nrxy | rnxny + RzILOpBool * or = OR(nrxy, rnxny); + + return or ; +} + +/** + * \brief Return the underflow bit when \p y is subtracted from \p x, with result \p res + * + * \param res + * \param x + * \param y + */ +static RzILOpBool *x86_il_is_sub_underflow(RZ_OWN RzILOpPure *res, RZ_OWN RzILOpPure *x, RZ_OWN RzILOpPure *y) { + // res = x - y + RzILOpBool *xmsb = MSB(x); + RzILOpBool *ymsb = MSB(y); + RzILOpBool *resmsb = MSB(res); + + // !res & x & !y + RzILOpBool *nrxny = AND(AND(INV(resmsb), xmsb), INV(ymsb)); + // res & !x & y + RzILOpBool *rnxy = AND(AND(DUP(resmsb), INV(DUP(xmsb))), DUP(ymsb)); + // or = nrxny | rnxy + RzILOpBool * or = OR(nrxny, rnxy); + + return or ; +} + +/** + * \brief Convert a bool \p b to a bitvector of length \p bits + * + * \param b + * \param bits + */ +static RzILOpBitVector *x86_bool_to_bv(RzILOpBool *b, unsigned int bits) { + return ITE(b, UN(bits, 1), UN(bits, 0)); +} + +struct x86_parity_helper_t { + RzILOpBool *val; ///< value of parity + RzILOpEffect *eff; ///< RzILOpEffect used to find the parity +}; + +/** + * \brief Find the parity of lower 8 bits of \p val + * + * \param val + */ +static struct x86_parity_helper_t x86_il_get_parity(RZ_OWN RzILOpPure *val) { + // assumed that val is an 8-bit wide value + RzILOpEffect *setvar = SETL("_popcnt", U8(0)); + setvar = SEQ2(setvar, SETL("_val", val)); + + /* We can stop shifting the "_val" once it is zero, + since the value of "_popcnt" wouldn't change any further */ + RzILOpBool *termination_cond = IS_ZERO(VARL("_val")); + + RzILOpEffect *popcnt = SETL("_popcnt", ADD(VARL("_popcnt"), x86_bool_to_bv(LSB(VARL("_val")), 8))); + popcnt = SEQ2(popcnt, SETL("_val", SHIFTR0(VARL("_val"), U8(1)))); + + RzILOpEffect *repeat_eff = REPEAT(termination_cond, popcnt); + + struct x86_parity_helper_t ret = { + .val = IS_ZERO(MOD(VARL("_popcnt"), U8(2))), + .eff = SEQ2(setvar, repeat_eff) + }; + + return ret; +} + +/** + * \brief Sets the value of PF, ZF, SF according to the \p result + */ +static RzILOpEffect *x86_il_set_result_flags_bits(RZ_OWN RzILOpPure *result, int bits) { + RzILOpEffect *set = SETL("_result", result); + struct x86_parity_helper_t pf = x86_il_get_parity(UNSIGNED(8, VARL("_result"))); + RzILOpBool *zf = IS_ZERO(VARL("_result")); + RzILOpBool *sf = MSB(VARL("_result")); + + return SEQ5(set, pf.eff, + SETG(EFLAGS(PF), pf.val), + SETG(EFLAGS(ZF), zf), + SETG(EFLAGS(SF), sf)); +} + +#define x86_il_set_result_flags(result) x86_il_set_result_flags_bits(result, analysis->bits) + +/** + * \brief Sets the value of CF, OF, AF according to the \p res + */ +static RzILOpEffect *x86_il_set_arithmetic_flags_bits(RZ_OWN RzILOpPure *res, RZ_OWN RzILOpPure *x, RZ_OWN RzILOpPure *y, bool addition, int bits) { + RzILOpBool *cf = NULL; + RzILOpBool *of = NULL; + RzILOpBool *af = NULL; + + RzILOpEffect *result_set = SETL("_result", res); + RzILOpEffect *x_set = SETL("_x", x); + RzILOpEffect *y_set = SETL("_y", y); + + if (addition) { + cf = x86_il_is_add_carry(VARL("_result"), VARL("_x"), VARL("_y")); + of = x86_il_is_add_overflow(VARL("_result"), VARL("_x"), VARL("_y")); + af = x86_il_is_add_carry(UNSIGNED(4, VARL("_result")), UNSIGNED(4, VARL("_x")), UNSIGNED(4, VARL("_y"))); + } else { + cf = x86_il_is_sub_borrow(VARL("_result"), VARL("_x"), VARL("_y")); + of = x86_il_is_sub_underflow(VARL("_result"), VARL("_x"), VARL("_y")); + af = x86_il_is_sub_borrow(UNSIGNED(4, VARL("_result")), UNSIGNED(4, VARL("_x")), UNSIGNED(4, VARL("_y"))); + } + + return SEQ6(result_set, x_set, y_set, + SETG(EFLAGS(CF), cf), + SETG(EFLAGS(OF), of), + SETG(EFLAGS(AF), af)); +} + +/** + * \brief Set OF and AF according to \p res + */ +static RzILOpEffect *x86_il_set_arithmetic_flags_except_cf_bits(RZ_OWN RzILOpPure *res, RZ_OWN RzILOpPure *x, RZ_OWN RzILOpPure *y, bool addition, int bits) { + RzILOpBool *of = NULL; + RzILOpBool *af = NULL; + + RzILOpEffect *result_set = SETL("_result", res); + RzILOpEffect *x_set = SETL("_x", x); + RzILOpEffect *y_set = SETL("_y", y); + + if (addition) { + of = x86_il_is_add_overflow(VARL("_result"), VARL("_x"), VARL("_y")); + af = x86_il_is_add_carry(UNSIGNED(4, VARL("_result")), UNSIGNED(4, VARL("_x")), UNSIGNED(4, VARL("_y"))); + } else { + of = x86_il_is_sub_underflow(VARL("_result"), VARL("_x"), VARL("_y")); + af = x86_il_is_sub_borrow(UNSIGNED(4, VARL("_result")), UNSIGNED(4, VARL("_x")), UNSIGNED(4, VARL("_y"))); + } + + return SEQ5(result_set, x_set, y_set, + SETG(EFLAGS(OF), of), + SETG(EFLAGS(AF), af)); +} + +#define x86_il_set_arithmetic_flags(res, x, y, addition) x86_il_set_arithmetic_flags_bits(res, x, y, addition, analysis->bits) +#define x86_il_set_arithmetic_flags_except_cf(res, x, y, addition) x86_il_set_arithmetic_flags_except_cf_bits(res, x, y, addition, analysis->bits) + +/** + * \brief Get value of FLAGS register + * + * \param size size of flags needed + */ +RzILOpPure *x86_il_get_flags(unsigned int size) { + /* We really don't care about bits higher than 16 for now */ + RzILOpPure *val; + if (size == 8) { + goto lower_half; + } + + /* Bit 15: Reserved, + always 1 on 8086 and 186, + always 0 on later models + Assuming 0 */ + val = x86_bool_to_bv(IL_FALSE, size); + val = LOGOR(SHIFTL0(val, UN(size, 1)), x86_bool_to_bv(VARG(EFLAGS(NT)), size)); + + /** Bit 12-13: IOPL, + I/O privilege level (286+ only), + always 1 on 8086 and 186 + Assuming all 1 */ + val = LOGOR(SHIFTL0(val, UN(size, 2)), UN(size, 0x3)); + val = LOGOR(SHIFTL0(val, UN(size, 1)), x86_bool_to_bv(VARG(EFLAGS(OF)), size)); + val = LOGOR(SHIFTL0(val, UN(size, 1)), x86_bool_to_bv(VARG(EFLAGS(DF)), size)); + val = LOGOR(SHIFTL0(val, UN(size, 1)), x86_bool_to_bv(VARG(EFLAGS(IF)), size)); + val = LOGOR(SHIFTL0(val, UN(size, 1)), x86_bool_to_bv(VARG(EFLAGS(TF)), size)); + +lower_half: + if (size == 8) { + val = x86_bool_to_bv(VARG(EFLAGS(SF)), size); + } else { + val = LOGOR(SHIFTL0(val, UN(size, 1)), x86_bool_to_bv(VARG(EFLAGS(ZF)), size)); + } + val = LOGOR(SHIFTL0(val, UN(size, 1)), x86_bool_to_bv(VARG(EFLAGS(ZF)), size)); + val = LOGOR(SHIFTL0(val, UN(size, 2)), x86_bool_to_bv(VARG(EFLAGS(AF)), size)); + val = LOGOR(SHIFTL0(val, UN(size, 2)), x86_bool_to_bv(VARG(EFLAGS(PF)), size)); + val = LOGOR(SHIFTL0(val, UN(size, 1)), UN(size, 1)); + val = LOGOR(SHIFTL0(val, UN(size, 1)), x86_bool_to_bv(VARG(EFLAGS(CF)), size)); + + return val; +} + +/** + * \brief Set the value of flags register + * + * \param val value to set the FLAGS register to + * \param size size of \p val + */ +RzILOpEffect *x86_il_set_flags(RZ_OWN RzILOpPure *val, unsigned int size) { + RzILOpEffect *set_val = SETL("_flags", val); + + RzILOpEffect *eff = SETG(EFLAGS(CF), LSB(VARL("_flags"))); + + eff = SEQ2(eff, SETL("_flags", SHIFTR0(VARL("_flags"), U8(2)))); + eff = SEQ2(eff, SETG(EFLAGS(PF), LSB(VARL("_flags")))); + eff = SEQ2(eff, SETL("_flags", SHIFTR0(VARL("_flags"), U8(2)))); + eff = SEQ2(eff, SETG(EFLAGS(AF), LSB(VARL("_flags")))); + eff = SEQ2(eff, SETL("_flags", SHIFTR0(VARL("_flags"), U8(2)))); + eff = SEQ2(eff, SETG(EFLAGS(ZF), LSB(VARL("_flags")))); + eff = SEQ2(eff, SETL("_flags", SHIFTR0(VARL("_flags"), U8(1)))); + eff = SEQ2(eff, SETG(EFLAGS(SF), LSB(VARL("_flags")))); + + if (size == 8) { + return SEQ2(set_val, eff); + } + + eff = SEQ2(eff, SETL("_flags", SHIFTR0(VARL("_flags"), U8(1)))); + eff = SEQ2(eff, SETG(EFLAGS(TF), LSB(VARL("_flags")))); + eff = SEQ2(eff, SETL("_flags", SHIFTR0(VARL("_flags"), U8(1)))); + eff = SEQ2(eff, SETG(EFLAGS(IF), LSB(VARL("_flags")))); + eff = SEQ2(eff, SETL("_flags", SHIFTR0(VARL("_flags"), U8(1)))); + eff = SEQ2(eff, SETG(EFLAGS(DF), LSB(VARL("_flags")))); + eff = SEQ2(eff, SETL("_flags", SHIFTR0(VARL("_flags"), U8(1)))); + eff = SEQ2(eff, SETG(EFLAGS(OF), LSB(VARL("_flags")))); + eff = SEQ2(eff, SETL("_flags", SHIFTR0(VARL("_flags"), U8(3)))); + eff = SEQ2(eff, SETG(EFLAGS(NT), LSB(VARL("_flags")))); + + /* Again, we will be ignoring bits over 16 and also ignore IOPL */ + + return SEQ2(set_val, eff); +} + +/** + * ======== INSTRUCTION DOCUMENTATION FORMAT ======== + * + * Instruction mnemonic + * Description + * | Opcode | 64-bit | Compat/Leg mode + */ + +/** + * \brief Invalid instruction + */ +IL_LIFTER(invalid) { + return NULL; +} + +/** + * \brief Unimplemnted instruction + */ +IL_LIFTER(unimpl) { + return EMPTY(); +} + +/* 8086/8088/80186/80286/80386/80486 instructions*/ + +/** + * AAA + * ASCII adjust AL after addition + * 37 | Invalid | Valid + */ +IL_LIFTER(aaa) { + RzILOpPure *low_al = LOGAND(x86_il_get_reg(X86_REG_AL), U8(0x0f)); + RzILOpPure *al_ovf = UGT(low_al, U8(9)); + RzILOpPure *cond = OR(al_ovf, VARG(EFLAGS(AF))); + + RzILOpEffect *set_ax = x86_il_set_reg(X86_REG_AX, ADD(x86_il_get_reg(X86_REG_AX), U16(0x106))); + RzILOpEffect *set_af = SETG(EFLAGS(AF), IL_TRUE); + RzILOpEffect *set_cf = SETG(EFLAGS(CF), IL_TRUE); + RzILOpEffect *true_cond = SEQ3(set_ax, set_af, set_cf); + + set_af = SETG(EFLAGS(AF), IL_FALSE); + set_cf = SETG(EFLAGS(CF), IL_FALSE); + RzILOpEffect *false_cond = SEQ2(set_af, set_cf); + + RzILOpEffect *final_cond = BRANCH(cond, true_cond, false_cond); + RzILOpEffect *set_al = x86_il_set_reg(X86_REG_AL, LOGAND(x86_il_get_reg(X86_REG_AL), U8(0x0f))); + + return SEQ2(final_cond, set_al); +} + +/** + * AAD imm8 + * Adjust AX before division to number base imm8 + * D5 ib | Invalid | Valid + */ +IL_LIFTER(aad) { + + RzILOpEffect *temp_al = SETL("temp_al", x86_il_get_reg(X86_REG_AL)); + RzILOpEffect *temp_ah = SETL("temp_ah", x86_il_get_reg(X86_REG_AH)); + + RzILOpPure *imm; + if (ins->structure->op_count == 0) { + // Use base 10 if none specified + imm = SN(8, 0x0a); + } else { + imm = x86_il_get_op(0); + } + + RzILOpPure *adjusted = ADD(VARL("temp_al"), MUL(VARL("temp_ah"), imm)); + adjusted = LOGAND(adjusted, U8(0xff)); + RzILOpEffect *adjusted_set = SETL("adjusted", adjusted); + + RzILOpEffect *set_flags = x86_il_set_result_flags(VARL("adjusted")); + + return SEQ6(temp_al, temp_ah, adjusted_set, x86_il_set_reg(X86_REG_AL, VARL("adjusted")), x86_il_set_reg(X86_REG_AH, U8(0)), set_flags); +} + +/** + * AAM imm8 + * Adjust AX after multiply to number base imm8 + * D4 ib | Invalid | Valid + */ +IL_LIFTER(aam) { + + RzILOpEffect *temp_al = SETL("temp_al", x86_il_get_reg(X86_REG_AL)); + + RzILOpPure *imm; + if (ins->structure->op_count == 0) { + imm = SN(8, 0xa); + } else { + imm = x86_il_get_op(0); + } + + RzILOpEffect *ah = x86_il_set_reg(X86_REG_AH, DIV(VARL("temp_al"), imm)); + RzILOpEffect *adjusted = SETL("adjusted", MOD(VARL("temp_al"), DUP(imm))); + RzILOpEffect *al = x86_il_set_reg(X86_REG_AL, VARL("adjusted")); + RzILOpEffect *set_flags = x86_il_set_result_flags(VARL("adjusted")); + + return SEQ5(temp_al, ah, adjusted, al, set_flags); +} + +/** + * AAS + * ASCII adjust AL after subtraction + * 3F | Invalid | Valid + */ +IL_LIFTER(aas) { + + RzILOpPure *low_al = LOGAND(x86_il_get_reg(X86_REG_AL), U8(0x0f)); + RzILOpPure *al_ovf = UGT(low_al, U8(9)); + RzILOpPure *cond = OR(al_ovf, VARG(EFLAGS(AF))); + + RzILOpEffect *set_ax = x86_il_set_reg(X86_REG_AX, SUB(x86_il_get_reg(X86_REG_AX), U16(0x6))); + RzILOpEffect *set_ah = x86_il_set_reg(X86_REG_AH, SUB(x86_il_get_reg(X86_REG_AH), U8(0x1))); + RzILOpEffect *set_af = SETG(EFLAGS(AF), IL_TRUE); + RzILOpEffect *set_cf = SETG(EFLAGS(CF), IL_TRUE); + RzILOpEffect *true_cond = SEQ4(set_ax, set_ah, set_af, set_cf); + + set_af = SETG(EFLAGS(AF), IL_FALSE); + set_cf = SETG(EFLAGS(CF), IL_FALSE); + RzILOpEffect *false_cond = SEQ2(set_af, set_cf); + + RzILOpEffect *final_cond = BRANCH(cond, true_cond, false_cond); + RzILOpEffect *set_al = x86_il_set_reg(X86_REG_AL, LOGAND(x86_il_get_reg(X86_REG_AL), U8(0x0f))); + + return SEQ2(final_cond, set_al); +} + +/** + * ADC dest, src + * (ADC family of instructions) + * Add with carry + * dest = dest + src + CF + * Possible encodings: + * - I + * - MI + * - MR + * - RM + */ +IL_LIFTER(adc) { + RzILOpEffect *op1 = SETL("op1", x86_il_get_op(0)); + RzILOpEffect *op2 = SETL("op2", x86_il_get_op(1)); + RzILOpPure *cf = VARG(EFLAGS(CF)); + + RzILOpEffect *sum = SETL("sum", ADD(ADD(VARL("op1"), VARL("op2")), x86_bool_to_bv(cf, ins->structure->operands[0].size * BITS_PER_BYTE))); + RzILOpEffect *set_dest = x86_il_set_op(0, VARL("sum")); + RzILOpEffect *set_res_flags = x86_il_set_result_flags(VARL("sum")); + RzILOpEffect *set_arith_flags = x86_il_set_arithmetic_flags(VARL("sum"), VARL("op1"), VARL("op2"), true); + + return SEQ6(op1, op2, sum, set_dest, set_res_flags, set_arith_flags); +} + +/** + * ADD dest, src + * (ADD family of instructions) + * Add + * dest = dest + src + * Possible encodings: + * - I + * - MI + * - MR + * - RM + */ +IL_LIFTER(add) { + RzILOpEffect *op1 = SETL("op1", x86_il_get_op(0)); + RzILOpEffect *op2 = SETL("op2", x86_il_get_op(1)); + RzILOpEffect *sum = SETL("sum", ADD(VARL("op1"), VARL("op2"))); + + RzILOpEffect *set_dest = x86_il_set_op(0, VARL("sum")); + RzILOpEffect *set_res_flags = x86_il_set_result_flags(VARL("sum")); + RzILOpEffect *set_arith_flags = x86_il_set_arithmetic_flags(VARL("sum"), VARL("op1"), VARL("op2"), true); + + return SEQ6(op1, op2, sum, set_dest, set_res_flags, set_arith_flags); +} + +/** + * AND dest, src + * (AND family of instructions) + * Logical and + * dest = dest & src + * Possible encodings: + * - I + * - MI + * - MR + * - RM + */ +IL_LIFTER(and) { + RzILOpPure *op1 = x86_il_get_op(0); + RzILOpPure *op2 = x86_il_get_op(1); + RzILOpEffect *and = SETL("and_", LOGAND(op1, op2)); + + RzILOpEffect *set_dest = x86_il_set_op(0, VARL("and_")); + RzILOpEffect *clear_of = SETG(EFLAGS(OF), IL_FALSE); + RzILOpEffect *clear_cf = SETG(EFLAGS(CF), IL_FALSE); + RzILOpEffect *set_res_flags = x86_il_set_result_flags(VARL("and_")); + + return SEQ5(and, set_dest, clear_of, clear_cf, set_res_flags); +} + +/** + * CBW + * Convert byte to word + * 98 | Valid | Valid + */ +IL_LIFTER(cbw) { + /* The UNSIGNED(16, ...) cast is useless in case of 32 bits, + but removing it will cause issues for 16-bit */ + return x86_il_set_reg(X86_REG_AX, UNSIGNED(16, x86_il_get_reg(X86_REG_AL))); +} + +/** + * CLC + * Clear carry flag + * F8 | Valid | Valid + */ +IL_LIFTER(clc) { + return SETG(EFLAGS(CF), IL_FALSE); +} + +/** + * CLD + * Clear direction flag + * FC | Valid | Valid + */ +IL_LIFTER(cld) { + return SETG(EFLAGS(DF), IL_FALSE); +} + +/** + * CLI + * Clear interrupt flag + * FA | Valid | Valid + */ +IL_LIFTER(cli) { + return SETG(EFLAGS(IF), IL_FALSE); +} + +/** + * CMC + * Complement carry flag + * F5 | Valid | Valid + */ +IL_LIFTER(cmc) { + return SETG(EFLAGS(CF), INV(VARG(EFLAGS(CF)))); +} + +/** + * CMP + * (CMP family of instructions) + * Compare two operands + * Possible encodings: + * - I + * - MI + * - MR + * - RM + */ +IL_LIFTER(cmp) { + RzILOpEffect *op1 = SETL("op1", x86_il_get_op(0)); + + RzILOpPure *second = x86_il_get_op(1); + RzILOpEffect *op2 = SETL("op2", second); + + RzILOpEffect *sub = SETL("sub", SUB(VARL("op1"), VARL("op2"))); + RzILOpEffect *arith = x86_il_set_arithmetic_flags(VARL("sub"), VARL("op1"), VARL("op2"), false); + RzILOpEffect *res = x86_il_set_result_flags(VARL("sub")); + + return SEQ5(op1, op2, sub, arith, res); +} + +RzILOpEffect *x86_il_cmp_helper(const X86ILIns *ins, ut64 pc, RzAnalysis *analysis, ut8 size) { + if (analysis->bits == 64) { + X86Reg mem_reg1 = X86_REG_RSI; + X86Reg mem_reg2 = X86_REG_RDI; + ut8 mem_size = 64; + + /* Address override prefix: 67H */ + if (ins->structure->prefix[3]) { + mem_reg1 = X86_REG_ESI; + mem_reg2 = X86_REG_EDI; + mem_size = 32; + } + + /* Cast to 64 if necessary (needed when address override prefix present) */ + RzILOpEffect *src1 = SETL("_src1", LOADW(size, (mem_size == 64 ? x86_il_get_reg(mem_reg1) : UNSIGNED(64, x86_il_get_reg(mem_reg1))))); + RzILOpEffect *src2 = SETL("_src2", LOADW(size, (mem_size == 64 ? x86_il_get_reg(mem_reg2) : UNSIGNED(64, x86_il_get_reg(mem_reg2))))); + RzILOpEffect *temp = SETL("_temp", SUB(VARL("_src1"), VARL("_src2"))); + + RzILOpEffect *arith_flags = x86_il_set_arithmetic_flags(VARL("_temp"), VARL("_src1"), VARL("_src2"), false); + RzILOpEffect *res_flags = x86_il_set_result_flags(VARL("_temp")); + + RzILOpEffect *increment = SEQ2(x86_il_set_reg(mem_reg1, ADD(x86_il_get_reg(mem_reg1), UN(mem_size, size / BITS_PER_BYTE))), x86_il_set_reg(mem_reg2, ADD(x86_il_get_reg(mem_reg2), UN(mem_size, size / BITS_PER_BYTE)))); + RzILOpEffect *decrement = SEQ2(x86_il_set_reg(mem_reg1, SUB(x86_il_get_reg(mem_reg1), UN(mem_size, size / BITS_PER_BYTE))), x86_il_set_reg(mem_reg2, SUB(x86_il_get_reg(mem_reg2), UN(mem_size, size / BITS_PER_BYTE)))); + + return SEQ6(src1, src2, temp, arith_flags, res_flags, BRANCH(VARG(EFLAGS(DF)), decrement, increment)); + } else { + X86Reg mem_reg1 = X86_REG_ESI; + X86Reg mem_reg2 = X86_REG_EDI; + ut8 mem_size = 32; + + /* Address override prefix: 67H */ + if (analysis->bits == 16 || ins->structure->prefix[3]) { + mem_reg1 = X86_REG_SI; + mem_reg2 = X86_REG_DI; + mem_size = 16; + } + + X86Mem src_mem1 = { + .base = mem_reg1, + .disp = 0, + .index = X86_REG_INVALID, + .scale = 1, + .segment = X86_REG_DS + }; + X86Mem src_mem2 = { + .base = mem_reg2, + .disp = 0, + .index = X86_REG_INVALID, + .scale = 1, + .segment = X86_REG_ES + }; + + /* No need for casting memaddr here since the casting will be done while calculating the segmented address */ + RzILOpEffect *src1 = SETL("_src1", LOADW(size, x86_il_get_memaddr(src_mem1))); + RzILOpEffect *src2 = SETL("_src2", LOADW(size, x86_il_get_memaddr(src_mem2))); + RzILOpEffect *temp = SETL("_temp", SUB(VARL("_src1"), VARL("_src2"))); + + RzILOpEffect *arith_flags = x86_il_set_arithmetic_flags(VARL("_temp"), VARL("_src1"), VARL("_src2"), false); + RzILOpEffect *res_flags = x86_il_set_result_flags(VARL("_temp")); + + RzILOpEffect *increment = SEQ2(x86_il_set_reg(mem_reg1, ADD(x86_il_get_reg(mem_reg1), UN(mem_size, size / BITS_PER_BYTE))), x86_il_set_reg(mem_reg2, ADD(x86_il_get_reg(mem_reg2), UN(mem_size, size / BITS_PER_BYTE)))); + RzILOpEffect *decrement = SEQ2(x86_il_set_reg(mem_reg1, SUB(x86_il_get_reg(mem_reg1), UN(mem_size, size / BITS_PER_BYTE))), x86_il_set_reg(mem_reg2, SUB(x86_il_get_reg(mem_reg2), UN(mem_size, size / BITS_PER_BYTE)))); + + return SEQ6(src1, src2, temp, arith_flags, res_flags, BRANCH(VARG(EFLAGS(DF)), increment, decrement)); + } +} + +/** + * CMPSB + * Compare byte + * A6 | Valid | Valid + */ +IL_LIFTER(cmpsb) { + return x86_il_cmp_helper(ins, pc, analysis, 8); +} + +/** + * CMPSW + * Compare word + * A7 | Valid | Valid + */ +IL_LIFTER(cmpsw) { + return x86_il_cmp_helper(ins, pc, analysis, 16); +} + +/** + * CMPSD + * Compare dword + * ZO + */ +IL_LIFTER(cmpsd) { + return x86_il_cmp_helper(ins, pc, analysis, 32); +} + +/** + * CMPSQ + * Compare quadword + * ZO + */ +IL_LIFTER(cmpsq) { + return x86_il_cmp_helper(ins, pc, analysis, 64); +} + +/** + * DAA + * Decimal adjust AL after addition + * 27 | Invalid | Valid + */ +IL_LIFTER(daa) { + + RzILOpEffect *old_al = SETL("old_al", x86_il_get_reg(X86_REG_AL)); + RzILOpEffect *old_cf = SETL("old_cf", VARG(EFLAGS(CF))); + + RzILOpEffect *set_cf = SETL(EFLAGS(CF), IL_FALSE); + + RzILOpBool *cond = UGT(LOGAND(x86_il_get_reg(X86_REG_AL), UN(8, 0xf)), UN(8, 9)); + cond = OR(cond, VARG(EFLAGS(AF))); + + RzILOpEffect *set_al = SETL("_al", x86_il_get_reg(X86_REG_AL)); + RzILOpEffect *sum = SETL("_sum", ADD(VARL("_al"), UN(8, 6))); + RzILOpEffect *true_cond = SEQ3(set_al, sum, x86_il_set_reg(X86_REG_AL, VARL("_sum"))); + RzILOpPure *new_cf = OR(VARL("old_cf"), x86_il_is_sub_borrow(VARL("_sum"), VARL("_al"), UN(8, 6))); + + RzILOpEffect *ret = SEQ4(old_al, old_cf, set_cf, BRANCH(cond, SEQ3(true_cond, SETG(EFLAGS(CF), new_cf), SETG(EFLAGS(AF), IL_TRUE)), SETG(EFLAGS(AF), IL_FALSE))); + + cond = OR(UGT(VARL("old_al"), UN(8, 0x99)), VARL("old_cf")); + + set_al = SETL("_al", x86_il_get_reg(X86_REG_AL)); + sum = SETL("_sum", ADD(VARL("_al"), UN(8, 0x60))); + true_cond = SEQ3(set_al, sum, x86_il_set_reg(X86_REG_AL, VARL("_sum"))); + + ret = SEQ3(ret, BRANCH(cond, SEQ2(true_cond, SETG(EFLAGS(CF), IL_TRUE)), SETG(EFLAGS(CF), IL_FALSE)), x86_il_set_result_flags(x86_il_get_reg(X86_REG_AL))); + + return ret; +} + +/** + * DAS + * Decimal adjust AL after subtraction + * 2F | Invalid | Valid + */ +IL_LIFTER(das) { + + RzILOpEffect *old_al = SETL("old_al", x86_il_get_reg(X86_REG_AL)); + RzILOpEffect *old_cf = SETL("old_cf", VARG(EFLAGS(CF))); + + RzILOpEffect *set_cf = SETL(EFLAGS(CF), IL_FALSE); + + RzILOpBool *cond = UGT(LOGAND(x86_il_get_reg(X86_REG_AL), UN(8, 0xf)), UN(8, 9)); + cond = OR(cond, VARG(EFLAGS(AF))); + + RzILOpEffect *set_al = SETL("_al", x86_il_get_reg(X86_REG_AL)); + RzILOpEffect *sum = SETL("_sum", SUB(VARL("_al"), UN(8, 6))); + RzILOpEffect *true_cond = SEQ3(set_al, sum, x86_il_set_reg(X86_REG_AL, VARL("_sum"))); + RzILOpPure *new_cf = OR(VARL("old_cf"), x86_il_is_sub_borrow(VARL("_sum"), VARL("_al"), UN(8, 6))); + + RzILOpEffect *ret = SEQ4(old_al, old_cf, set_cf, BRANCH(cond, SEQ3(true_cond, SETG(EFLAGS(CF), new_cf), SETG(EFLAGS(AF), IL_TRUE)), SETG(EFLAGS(AF), IL_FALSE))); + + cond = OR(UGT(VARL("old_al"), UN(8, 0x99)), VARL("old_cf")); + + set_al = SETL("_al", x86_il_get_reg(X86_REG_AL)); + sum = SETL("_sum", SUB(VARL("_al"), UN(8, 0x60))); + true_cond = SEQ3(set_al, sum, x86_il_set_reg(X86_REG_AL, VARL("_sum"))); + + ret = SEQ3(ret, BRANCH(cond, SEQ2(true_cond, SETG(EFLAGS(CF), IL_TRUE)), NOP()), x86_il_set_result_flags(x86_il_get_reg(X86_REG_AL))); + + return ret; +} + +/** + * DEC + * Decrement by 1 + * Operand can be a memory address or a register + */ +IL_LIFTER(dec) { + RzILOpEffect *op = SETL("_op", x86_il_get_op(0)); + RzILOpEffect *dec = SETL("_dec", SUB(VARL("_op"), UN(ins->structure->operands[0].size * BITS_PER_BYTE, 1))); + + RzILOpEffect *set_result = x86_il_set_op(0, VARL("_dec")); + RzILOpEffect *res_flags = x86_il_set_result_flags(VARL("_dec")); + + RzILOpEffect *arith_flags = x86_il_set_arithmetic_flags_except_cf(VARL("_dec"), VARL("_op"), UN(ins->structure->operands[0].size * BITS_PER_BYTE, 1), false); + + return SEQ5(op, dec, set_result, res_flags, arith_flags); +} + +/** + * DIV + * Unsigned division + * One operand (memory address), used as the divisor + */ +IL_LIFTER(div) { + RzILOpEffect *ret = NULL; + + switch (ins->structure->operands[0].size) { + case 1: { + /* Word/Byte operation */ + RzILOpEffect *ax = SETL("_ax", x86_il_get_reg(X86_REG_AX)); + RzILOpEffect *temp = SETL("_temp", UNSIGNED(8, DIV(VARL("_ax"), VARL("_src")))); + + RzILOpPure *cond = UGT(VARL("_temp"), UN(8, 0xff)); + RzILOpEffect *else_cond = SEQ2(x86_il_set_reg(X86_REG_AL, VARL("_temp")), x86_il_set_reg(X86_REG_AH, MOD(VARL("_ax"), VARL("_src")))); + + ret = SEQ3(ax, temp, BRANCH(cond, NULL, else_cond)); + break; + } + case 2: { + /* Doubleword/Word operation */ + RzILOpEffect *dxax = SETL("_dxax", LOGOR(SHIFTL0(UNSIGNED(32, x86_il_get_reg(X86_REG_DX)), UN(8, 16)), UNSIGNED(32, x86_il_get_reg(X86_REG_AX)))); + RzILOpEffect *temp = SETL("_temp", UNSIGNED(16, DIV(VARL("_dxax"), VARL("_src")))); + + RzILOpPure *cond = UGT(VARL("_temp"), UN(16, 0xffff)); + RzILOpEffect *else_cond = SEQ2(x86_il_set_reg(X86_REG_AX, VARL("_temp")), x86_il_set_reg(X86_REG_DX, MOD(VARL("_dxax"), VARL("_src")))); + + ret = SEQ3(dxax, temp, BRANCH(cond, NULL, else_cond)); + break; + } + case 4: { + /* Quadword/Doubleword operation */ + RzILOpEffect *edxeax = SETL("_edxeax", LOGOR(SHIFTL0(UNSIGNED(64, x86_il_get_reg(X86_REG_EDX)), UN(8, 32)), UNSIGNED(64, x86_il_get_reg(X86_REG_EAX)))); + RzILOpEffect *temp = SETL("_temp", UNSIGNED(32, DIV(VARL("_edxeax"), VARL("_src")))); + + RzILOpPure *cond = UGT(VARL("_temp"), UN(32, 0xffffffffULL)); + RzILOpEffect *else_cond = SEQ2(x86_il_set_reg(X86_REG_AX, VARL("_temp")), x86_il_set_reg(X86_REG_DX, MOD(VARL("_edxeax"), VARL("_src")))); + + ret = SEQ3(edxeax, temp, BRANCH(cond, NULL, else_cond)); + break; + } + case 8: { + /* Doublequadword/Quadword operation */ + RzILOpEffect *rdxrax = SETL("_rdxrax", LOGOR(SHIFTL0(UNSIGNED(128, x86_il_get_reg(X86_REG_RDX)), UN(8, 64)), UNSIGNED(128, x86_il_get_reg(X86_REG_RAX)))); + RzILOpEffect *temp = SETL("_temp", UNSIGNED(64, DIV(VARL("_rdxrax"), VARL("_src")))); + + RzILOpPure *cond = UGT(VARL("_temp"), UN(64, 0xffffffffffffffffULL)); + RzILOpEffect *else_cond = SEQ2(x86_il_set_reg(X86_REG_AX, VARL("_temp")), x86_il_set_reg(X86_REG_DX, MOD(VARL("_rdxrax"), VARL("_src")))); + + ret = SEQ3(rdxrax, temp, BRANCH(cond, NULL, else_cond)); + break; + } + default: + RZ_LOG_ERROR("RzIL: x86: DIV: Invalid operand size\n"); + return NULL; + } + + /* We need the divisor to be as wide as the operand, since the sizes of the dividend and the divisor need to match */ + RzILOpEffect *op = SETL("_src", UNSIGNED(ins->structure->operands[0].size * 2 * BITS_PER_BYTE, x86_il_get_op(0))); + + /* Check if the operand is zero, return NULL if it is (to avoid divide by zero) */ + return SEQ2(op, BRANCH(IS_ZERO(VARL("_src")), NULL, ret)); +} + +// /** +// * ESC +// * Escape to coprocessor instruction set +// * To be used with floating-point unit +// */ +// IL_LIFTER(esc) { +// /* Not necessary to implement for binary analysis */ +// return EMPTY(); +// } + +/** + * HLT + * Enter HALT state + */ +IL_LIFTER(hlt) { + /* It just jumps to an empty goto label "halt" + Also need an EMPTY() instruction after it to denote + the end of analysis and restart all IL analysis */ + return SEQ2(GOTO("halt"), EMPTY()); +} + +static void label_halt(RzILVM *vm, RzILOpEffect *op) { + // empty "halt" label + return; +} + +/** + * IDIV + * Signed division + * One operand (memory address), used as the divisor + */ +IL_LIFTER(idiv) { + RzILOpEffect *ret = NULL; + + switch (ins->structure->operands[0].size) { + case 1: { + /* Word/Byte operation */ + RzILOpEffect *ax = SETL("_ax", x86_il_get_reg(X86_REG_AX)); + RzILOpEffect *temp = SETL("_temp", UNSIGNED(8, SDIV(VARL("_ax"), VARL("_src")))); + + RzILOpPure *cond = OR(SGT(VARL("_temp"), UN(8, 0x7f)), SLT(VARL("_temp"), UN(8, 0x80))); + RzILOpEffect *else_cond = SEQ2(x86_il_set_reg(X86_REG_AL, VARL("_temp")), x86_il_set_reg(X86_REG_AH, SMOD(VARL("_ax"), VARL("_src")))); + + ret = SEQ3(ax, temp, BRANCH(cond, NULL, else_cond)); + break; + } + case 2: { + /* Doubleword/Word operation */ + RzILOpEffect *dxax = SETL("_dxax", LOGOR(SHIFTL0(UNSIGNED(32, x86_il_get_reg(X86_REG_DX)), UN(8, 16)), UNSIGNED(32, x86_il_get_reg(X86_REG_AX)))); + RzILOpEffect *temp = SETL("_temp", UNSIGNED(16, SDIV(VARL("_dxax"), VARL("_src")))); + + RzILOpPure *cond = OR(SGT(VARL("_temp"), UN(16, 0x7fff)), SLT(VARL("_temp"), UN(16, 0x8000))); + RzILOpEffect *else_cond = SEQ2(x86_il_set_reg(X86_REG_AX, VARL("_temp")), x86_il_set_reg(X86_REG_DX, SMOD(VARL("_dxax"), VARL("_src")))); + + ret = SEQ3(dxax, temp, BRANCH(cond, NULL, else_cond)); + break; + } + case 4: { + /* Quadword/Doubleword operation */ + RzILOpEffect *edxeax = SETL("_edxeax", LOGOR(SHIFTL0(UNSIGNED(64, x86_il_get_reg(X86_REG_EDX)), UN(8, 32)), UNSIGNED(64, x86_il_get_reg(X86_REG_EAX)))); + RzILOpEffect *temp = SETL("_temp", UNSIGNED(32, SDIV(VARL("_edxeax"), VARL("_src")))); + + RzILOpPure *cond = OR(SGT(VARL("_temp"), UN(32, 0x7fffffffULL)), SLT(VARL("_temp"), UN(32, 0x80000000ULL))); + RzILOpEffect *else_cond = SEQ2(x86_il_set_reg(X86_REG_AX, VARL("_temp")), x86_il_set_reg(X86_REG_DX, SMOD(VARL("_edxeax"), VARL("_src")))); + + ret = SEQ3(edxeax, temp, BRANCH(cond, NULL, else_cond)); + break; + } + case 8: { + /* Doublequadword/Quadword operation */ + RzILOpEffect *rdxrax = SETL("_rdxrax", LOGOR(SHIFTL0(UNSIGNED(128, x86_il_get_reg(X86_REG_EDX)), UN(8, 64)), UNSIGNED(128, x86_il_get_reg(X86_REG_EAX)))); + RzILOpEffect *temp = SETL("_temp", UNSIGNED(64, SDIV(VARL("_rdxrax"), VARL("_src")))); + + RzILOpPure *cond = OR(SGT(VARL("_temp"), UN(64, 0x7fffffffffffffffULL)), SLT(VARL("_temp"), UN(64, 0x8000000000000000ULL))); + RzILOpEffect *else_cond = SEQ2(x86_il_set_reg(X86_REG_AX, VARL("_temp")), x86_il_set_reg(X86_REG_DX, SMOD(VARL("_rdxrax"), VARL("_src")))); + + ret = SEQ3(rdxrax, temp, BRANCH(cond, NULL, else_cond)); + break; + } + default: + RZ_LOG_ERROR("RzIL: x86: IDIV: Invalid operand size\n"); + return NULL; + } + + /* We need the divisor to be as wide as the operand, since the sizes of the dividend and the divisor need to match */ + RzILOpEffect *op = SETL("_src", UNSIGNED(ins->structure->operands[0].size * 2 * BITS_PER_BYTE, x86_il_get_op(0))); + + /* Check if the operand is zero, return NULL if it is (to avoid divide by zero) */ + return SEQ2(op, BRANCH(IS_ZERO(VARL("_src")), NULL, ret)); +} + +/** + * IMUL + * Signed multiply + * Three different operand number: + * - One operand (Encoding: M) + * - Two operands (Encoding: RM) + * - Three operands (Encoding: RMI) + */ +IL_LIFTER(imul) { + switch (ins->structure->op_count) { + case 1: { + switch (ins->structure->operands[0].size) { + case 1: { + RzILOpEffect *tmp_xp = SETL("_tmp_xp", MUL(SIGNED(16, x86_il_get_reg(X86_REG_AL)), SIGNED(16, x86_il_get_op(0)))); + RzILOpEffect *set_ax = x86_il_set_reg(X86_REG_AX, VARL("_tmp_xp")); + + /* Check if the result fits in a byte */ + RzILOpPure *cond = EQ(SIGNED(16, UNSIGNED(8, VARL("_tmp_xp"))), VARL("_tmp_xp")); + RzILOpEffect *true_branch = SEQ2(SETG(EFLAGS(CF), IL_FALSE), SETG(EFLAGS(OF), IL_FALSE)); + RzILOpEffect *false_branch = SEQ2(SETG(EFLAGS(CF), IL_TRUE), SETG(EFLAGS(OF), IL_TRUE)); + + return SEQ3(tmp_xp, set_ax, BRANCH(cond, true_branch, false_branch)); + } + case 2: { + RzILOpEffect *tmp_xp = SETL("_tmp_xp", MUL(SIGNED(32, x86_il_get_reg(X86_REG_AX)), SIGNED(32, x86_il_get_op(0)))); + RzILOpEffect *set_ax = x86_il_set_reg(X86_REG_AX, UNSIGNED(16, VARL("_tmp_xp"))); + RzILOpEffect *set_dx = x86_il_set_reg(X86_REG_DX, UNSIGNED(32, SHIFTR0(VARL("_tmp_xp"), UN(8, 16)))); + + /* Check if the result fits in a word */ + RzILOpPure *cond = EQ(SIGNED(32, UNSIGNED(16, VARL("_tmp_xp"))), VARL("_tmp_xp")); + RzILOpEffect *true_branch = SEQ2(SETG(EFLAGS(CF), IL_FALSE), SETG(EFLAGS(OF), IL_FALSE)); + RzILOpEffect *false_branch = SEQ2(SETG(EFLAGS(CF), IL_TRUE), SETG(EFLAGS(OF), IL_TRUE)); + + return SEQ4(tmp_xp, set_ax, set_dx, BRANCH(cond, true_branch, false_branch)); + } + case 4: { + RzILOpEffect *tmp_xp = SETL("_tmp_xp", MUL(SIGNED(64, x86_il_get_reg(X86_REG_EAX)), SIGNED(64, x86_il_get_op(0)))); + RzILOpEffect *set_eax = x86_il_set_reg(X86_REG_EAX, UNSIGNED(32, VARL("_tmp_xp"))); + RzILOpEffect *set_edx = x86_il_set_reg(X86_REG_EDX, UNSIGNED(32, SHIFTR0(VARL("_tmp_xp"), UN(8, 32)))); + + /* Check if the result fits in a doubleword */ + RzILOpPure *cond = EQ(SIGNED(64, UNSIGNED(32, VARL("_tmp_xp"))), VARL("_tmp_xp")); + RzILOpEffect *true_branch = SEQ2(SETG(EFLAGS(CF), IL_FALSE), SETG(EFLAGS(OF), IL_FALSE)); + RzILOpEffect *false_branch = SEQ2(SETG(EFLAGS(CF), IL_TRUE), SETG(EFLAGS(OF), IL_TRUE)); + + return SEQ4(tmp_xp, set_eax, set_edx, BRANCH(cond, true_branch, false_branch)); + } + case 8: { + RzILOpEffect *tmp_xp = SETL("_tmp_xp", MUL(SIGNED(128, x86_il_get_reg(X86_REG_RAX)), SIGNED(128, x86_il_get_op(0)))); + RzILOpEffect *set_rax = x86_il_set_reg(X86_REG_RAX, UNSIGNED(64, VARL("_tmp_xp"))); + RzILOpEffect *set_rdx = x86_il_set_reg(X86_REG_RDX, UNSIGNED(64, SHIFTR0(VARL("_tmp_xp"), UN(8, 64)))); + + /* Check if the result fits in a quadword */ + RzILOpPure *cond = EQ(SIGNED(128, UNSIGNED(64, VARL("_tmp_xp"))), VARL("_tmp_xp")); + RzILOpEffect *true_branch = SEQ2(SETG(EFLAGS(CF), IL_FALSE), SETG(EFLAGS(OF), IL_FALSE)); + RzILOpEffect *false_branch = SEQ2(SETG(EFLAGS(CF), IL_TRUE), SETG(EFLAGS(OF), IL_TRUE)); + + return SEQ4(tmp_xp, set_rax, set_rdx, BRANCH(cond, true_branch, false_branch)); + } + default: + RZ_LOG_ERROR("RzIL: x86: IMUL: Invalid operand size\n"); + return NULL; + } + } + case 2: { + RzILOpEffect *dest = SETL("_dest", x86_il_get_op(0)); + RzILOpEffect *tmp_xp = SETL("_tmp_xp", MUL(SIGNED(ins->structure->operands[0].size * 2 * BITS_PER_BYTE, VARL("_dest")), SIGNED(ins->structure->operands[0].size * 2 * BITS_PER_BYTE, x86_il_get_op(1)))); + RzILOpEffect *set_dest = SETL("_dest", UNSIGNED(ins->structure->operands[0].size * BITS_PER_BYTE, VARL("_tmp_xp"))); + RzILOpEffect *set_operand = x86_il_set_op(0, VARL("_dest")); + + /* Check if the result fits in the destination */ + RzILOpPure *cond = EQ(SIGNED(ins->structure->operands[0].size * 2 * BITS_PER_BYTE, VARL("_dest")), VARL("_tmp_xp")); + RzILOpEffect *true_branch = SEQ2(SETG(EFLAGS(CF), IL_FALSE), SETG(EFLAGS(OF), IL_FALSE)); + RzILOpEffect *false_branch = SEQ2(SETG(EFLAGS(CF), IL_TRUE), SETG(EFLAGS(OF), IL_TRUE)); + + return SEQ5(dest, tmp_xp, set_dest, set_operand, BRANCH(cond, true_branch, false_branch)); + } + case 3: { + RzILOpEffect *tmp_xp = SETL("_tmp_xp", MUL(SIGNED(ins->structure->operands[1].size * 2 * BITS_PER_BYTE, x86_il_get_op(1)), SIGNED(ins->structure->operands[1].size * 2 * BITS_PER_BYTE, x86_il_get_op(2)))); + RzILOpEffect *set_dest = SETL("_dest", UNSIGNED(ins->structure->operands[0].size * BITS_PER_BYTE, VARL("_tmp_xp"))); + RzILOpEffect *set_operand = x86_il_set_op(0, VARL("_dest")); + + /* Check if the result fits in the destination */ + RzILOpPure *cond = EQ(SIGNED(ins->structure->operands[0].size * 2 * BITS_PER_BYTE, VARL("_dest")), VARL("_tmp_xp")); + RzILOpEffect *true_branch = SEQ2(SETG(EFLAGS(CF), IL_FALSE), SETG(EFLAGS(OF), IL_FALSE)); + RzILOpEffect *false_branch = SEQ2(SETG(EFLAGS(CF), IL_TRUE), SETG(EFLAGS(OF), IL_TRUE)); + + return SEQ4(tmp_xp, set_dest, set_operand, BRANCH(cond, true_branch, false_branch)); + } + default: + RZ_LOG_ERROR("RzIL: x86: IMUL: Invalid operand count\n"); + return NULL; + } + + return NULL; +} + +/** + * IN + * Input from port + * Encodings: I, ZO + */ +IL_LIFTER(in) { + /* It just jumps to an empty goto label "port" + Also need an EMPTY() instruction after it to denote + the end of analysis and restart all IL analysis */ + return SEQ2(GOTO("port"), EMPTY()); +} + +static void label_port(RzILVM *vm, RzILOpEffect *op) { + // empty "port" label + return; +} + +/** + * INC + * Increment by 1 + * Encodings: M, O + */ +IL_LIFTER(inc) { + RzILOpEffect *op = SETL("_op", x86_il_get_op(0)); + RzILOpEffect *result = SETL("_result", ADD(VARL("_op"), UN(ins->structure->operands[0].size * BITS_PER_BYTE, 1))); + RzILOpEffect *set_result = x86_il_set_op(0, VARL("_result")); + + RzILOpEffect *arith_flags = x86_il_set_arithmetic_flags_except_cf(VARL("_result"), VARL("_op"), UN(ins->structure->operands[0].size * BITS_PER_BYTE, 1), true); + RzILOpEffect *res_flags = x86_il_set_result_flags(VARL("_result")); + + return SEQ5(op, result, set_result, arith_flags, res_flags); +} + +/** + * INT + * Call to interrupt procedure + * Encodings: I, ZO + */ +IL_LIFTER(int) { + /* For now, it just jumps to an empty goto label "int" + Also need an EMPTY() instruction after it to denote + the end of analysis and restart all IL analysis */ + return SEQ2(GOTO("int"), EMPTY()); +} + +static void label_int(RzILVM *vm, RzILOpEffect *op) { + // empty "int" label + return; +} + +/** + * INTO + * Call to interrupt if overflow flag set + */ +IL_LIFTER(into) { + return BRANCH(VARG(EFLAGS(OF)), SEQ2(GOTO("int"), EMPTY()), NOP()); +} + +// /** +// * IRET +// * Return from interrupt +// */ +// IL_LIFTER(iret) { +// /* TODO: Implement IRET properly */ +// return EMPTY(); +// } + +#define JUMP_IL() \ + do { \ + RzILOpPure *jmp_addr = UN(analysis->bits, pc); \ + jmp_addr = ADD(jmp_addr, SN(analysis->bits, ins->structure->operands[0].imm)); \ + if (ins->structure->operands[0].size == 16 && analysis->bits != 64) { \ + jmp_addr = LOGAND(jmp_addr, UN(analysis->bits, 0x0000ffff)); \ + } \ + return BRANCH(cond, JMP(jmp_addr), NOP()); \ + } while (0) + +/** + * JA + * Jump if above (CF = 0 and ZF = 0) + * Encoding: D + */ +IL_LIFTER(ja) { + RzILOpBool *cond = AND(INV(VARG(EFLAGS(CF))), INV(VARG(EFLAGS(ZF)))); + JUMP_IL(); +} + +/** + * JAE + * Jump if above or equal (CF = 0) + * Encoding: D + */ +IL_LIFTER(jae) { + RzILOpBool *cond = INV(VARG(EFLAGS(CF))); + JUMP_IL(); +} + +/** + * JB + * Jump if below (CF = 1) + * Encoding: D + */ +IL_LIFTER(jb) { + RzILOpBool *cond = VARG(EFLAGS(CF)); + JUMP_IL(); +} + +/** + * JBE + * Jump if below or equal (CF = 1 or ZF = 1) + * Encoding: D + */ +IL_LIFTER(jbe) { + RzILOpBool *cond = OR(VARG(EFLAGS(CF)), VARG(EFLAGS(ZF))); + JUMP_IL(); +} + +/** + * JCXZ + * Jump if CX register is zero (CX = 0) + * Encoding: D + */ +IL_LIFTER(jcxz) { + RzILOpBool *cond = IS_ZERO(x86_il_get_reg(X86_REG_CX)); + JUMP_IL(); +} + +/** + * JECXZ + * Jump if ECX register is zero (ECX = 0) + * Encoding: D + */ +IL_LIFTER(jecxz) { + RzILOpBool *cond = IS_ZERO(x86_il_get_reg(X86_REG_ECX)); + JUMP_IL(); +} + +/** + * JRCXZ + * Jump if RCX register is zero (RCX = 0) + * Encoding: D + */ +IL_LIFTER(jrcxz) { + RzILOpBool *cond = IS_ZERO(x86_il_get_reg(X86_REG_RCX)); + JUMP_IL(); +} + +/** + * JE + * Jump if equal (ZF = 1) + * Encoding: D + */ +IL_LIFTER(je) { + RzILOpBool *cond = VARG(EFLAGS(ZF)); + JUMP_IL(); +} + +/** + * JG + * Jump if greater (ZF = 0 and SF = OF) + * Encoding: D + */ +IL_LIFTER(jg) { + RzILOpBool *cond = AND(INV(VARG(EFLAGS(ZF))), INV(XOR(VARG(EFLAGS(SF)), VARG(EFLAGS(OF))))); + JUMP_IL(); +} + +/** + * JGE + * Jump if greater or equal (SF = OF) + * Encoding: D + */ +IL_LIFTER(jge) { + RzILOpBool *cond = INV(XOR(VARG(EFLAGS(SF)), VARG(EFLAGS(OF)))); + JUMP_IL(); +} + +/** + * JL + * Jump if less or equal (SF != OF) + * Encoding: D + */ +IL_LIFTER(jl) { + RzILOpBool *cond = XOR(VARG(EFLAGS(SF)), VARG(EFLAGS(OF))); + JUMP_IL(); +} + +/** + * JLE + * Jump if less or equal (ZF = 1 or SF != OF) + * Encoding: D + */ +IL_LIFTER(jle) { + RzILOpBool *cond = OR(VARG(EFLAGS(ZF)), XOR(VARG(EFLAGS(SF)), VARG(EFLAGS(OF)))); + JUMP_IL(); +} + +/** + * JNE + * Jump if not equal (ZF = 0) + * Encoding: D + */ +IL_LIFTER(jne) { + RzILOpBool *cond = INV(VARG(EFLAGS(ZF))); + JUMP_IL(); +} + +/** + * JNO + * Jump if not overflow (OF = 0) + * Encoding: D + */ +IL_LIFTER(jno) { + RzILOpBool *cond = INV(VARG(EFLAGS(OF))); + JUMP_IL(); +} + +/** + * JNP + * Jump if not parity (PF = 0) + * Encoding: D + */ +IL_LIFTER(jnp) { + RzILOpBool *cond = INV(VARG(EFLAGS(PF))); + JUMP_IL(); +} + +/** + * JNS + * Jump if not sign (SF = 0) + * Encoding: D + */ +IL_LIFTER(jns) { + RzILOpBool *cond = INV(VARG(EFLAGS(SF))); + JUMP_IL(); +} + +/** + * JO + * Jump if overflow (OF = 1) + * Encoding: D + */ +IL_LIFTER(jo) { + RzILOpBool *cond = VARG(EFLAGS(OF)); + JUMP_IL(); +} + +/** + * JP + * Jump if parity (PF = 1) + * Encoding: D + */ +IL_LIFTER(jp) { + RzILOpBool *cond = VARG(EFLAGS(PF)); + JUMP_IL(); +} + +/** + * JS + * Jump if sign (SF = 1) + * Encoding: D + */ +IL_LIFTER(js) { + RzILOpBool *cond = VARG(EFLAGS(SF)); + JUMP_IL(); +} + +#undef JUMP_IL + +/** + * JMP + * Jump + * Relative jump or absolute jump decided by the encoding of the operands + * Possible encodings: + * - S (Segment + absolute address) + * - D (Offset/Displacement) + * - M + */ +IL_LIFTER(jmp) { + RzILOpPure *target; + if (ins->structure->operands[0].type == X86_OP_IMM) { + target = ADD(UN(analysis->bits, pc), SN(analysis->bits, ins->structure->operands[0].imm)); + } else { + target = UNSIGNED(analysis->bits, x86_il_get_op(0)); + } + + return JMP(target); +} + +/** + * LAHF + * Load status flags in the AH register + * No operands + */ +IL_LIFTER(lahf) { + return x86_il_set_reg(X86_REG_AH, x86_il_get_flags(8)); +} + +/** + * LDS + * Load pointer using DS + * Encoding: RM + */ +IL_LIFTER(lds) { + return x86_il_set_op(0, x86_il_get_memaddr_segment(ins->structure->operands[1].mem, X86_REG_DS)); +} + +/** + * LEA + * Load effective address + * Encoding: RM + * Cast the M to R in an unsigned cast + */ +IL_LIFTER(lea) { + return x86_il_set_op(0, x86_il_get_memaddr(ins->structure->operands[1].mem)); +} + +/** + * LES + * Load pointer using ES + * Encoding: RM + */ +IL_LIFTER(les) { + return x86_il_set_op(0, x86_il_get_memaddr_segment(ins->structure->operands[1].mem, X86_REG_ES)); +} + +RzILOpEffect *x86_il_lods_helper(const X86ILIns *ins, ut64 pc, RzAnalysis *analysis, ut8 size) { + X86Reg reg; + switch (size) { + case 8: + reg = X86_REG_AL; + break; + case 16: + reg = X86_REG_AX; + break; + case 32: + reg = X86_REG_EAX; + break; + case 64: + reg = X86_REG_RAX; + break; + default: + rz_warn_if_reached(); + return NULL; + } + + if (analysis->bits == 64) { + X86Reg mem_reg = X86_REG_RSI; + ut8 mem_size = 64; + /* Address override prefix: 67H */ + if (ins->structure->prefix[3]) { + mem_reg = X86_REG_ESI; + mem_size = 32; + } + + /* Cast to 64 if necessary (needed when address override prefix present) */ + RzILOpPure *val = LOADW(size, (mem_size == 64 ? x86_il_get_reg(mem_reg) : UNSIGNED(64, x86_il_get_reg(mem_reg)))); + RzILOpEffect *inc = x86_il_set_reg(mem_reg, ADD(x86_il_get_reg(mem_reg), UN(mem_size, size / BITS_PER_BYTE))); + RzILOpEffect *dec = x86_il_set_reg(mem_reg, SUB(x86_il_get_reg(mem_reg), UN(mem_size, size / BITS_PER_BYTE))); + RzILOpEffect *update_rsi = BRANCH(VARG(EFLAGS(DF)), dec, inc); + + return SEQ2(x86_il_set_reg(reg, val), update_rsi); + + } else { + X86Reg mem_reg = X86_REG_ESI; + ut8 mem_size = 32; + /* Address override prefix: 67H */ + if (analysis->bits == 16 || ins->structure->prefix[3]) { + mem_reg = X86_REG_SI; + mem_size = 16; + } + + X86Mem src_mem; + src_mem.base = mem_reg; + src_mem.disp = 0; + src_mem.index = X86_REG_INVALID; + src_mem.scale = 1; + src_mem.segment = X86_REG_DS; + + /* No need for casting memaddr here since the casting will be done while calculating the segmented address */ + RzILOpPure *val = LOADW(size, x86_il_get_memaddr(src_mem)); + + RzILOpEffect *inc = x86_il_set_reg(mem_reg, ADD(x86_il_get_reg(mem_reg), UN(mem_size, size / BITS_PER_BYTE))); + RzILOpEffect *dec = x86_il_set_reg(mem_reg, SUB(x86_il_get_reg(mem_reg), UN(mem_size, size / BITS_PER_BYTE))); + RzILOpEffect *update_si = BRANCH(VARG(EFLAGS(DF)), dec, inc); + + return SEQ2(x86_il_set_reg(reg, val), update_si); + } +} + +/** + * LODSB + * Load string byte + * No operands + */ +IL_LIFTER(lodsb) { + return x86_il_lods_helper(ins, pc, analysis, 8); +} + +/** + * LODSW + * Load string word + * No operands + */ +IL_LIFTER(lodsw) { + return x86_il_lods_helper(ins, pc, analysis, 16); +} + +/** + * LODSD + * Load string dword + * No operands + */ +IL_LIFTER(lodsd) { + return x86_il_lods_helper(ins, pc, analysis, 32); +} + +/** + * LODSQ + * Load string quadword + * No operands + */ +IL_LIFTER(lodsq) { + return x86_il_lods_helper(ins, pc, analysis, 64); +} + +#define LOOP_HELPER(cond) \ + do { \ + /* Will automatically be resolved to the widest CX register */ \ + X86Reg count_reg = X86_REG_RCX; \ +\ + uint8_t addr_size = analysis->bits; \ + /* Check address override prefix (67H) */ \ + if (analysis->bits == 64 && ins->structure->prefix[3]) { \ + addr_size >>= 1; \ + count_reg = X86_REG_ECX; \ + } \ +\ + RzILOpEffect *dec_counter = x86_il_set_reg(count_reg, SUB(x86_il_get_reg(count_reg), UN(addr_size, 1))); \ + RzILOpEffect *true_cond = JMP(UN(analysis->bits, pc + ins->structure->operands[0].imm)); \ + RzILOpEffect *branch = BRANCH(cond, true_cond, NOP()); \ +\ + return SEQ2(dec_counter, branch); \ + } while (0) + +/** + * LOOP + * Loop the following instruction + * Encoding: D + * Decrement count ; jump if count != 0 + */ +IL_LIFTER(loop) { + LOOP_HELPER(NON_ZERO(x86_il_get_reg(count_reg))); +} + +/** + * LOOPE + * Loop the following instruction + * Encoding: D + * Decrement count ; jump if count != 0 and ZF = 1 + */ +IL_LIFTER(loope) { + LOOP_HELPER(AND(NON_ZERO(x86_il_get_reg(count_reg)), VARG(EFLAGS(ZF)))); +} + +/** + * LOOPNE + * Loop the following instruction + * Encoding: D + * Decrement count ; jump if count != 0 and ZF = 0 + */ +IL_LIFTER(loopne) { + LOOP_HELPER(AND(NON_ZERO(x86_il_get_reg(count_reg)), INV(VARG(EFLAGS(ZF))))); +} + +/** + * MOV + * Move + * Encodings: + * - MR + * - RM + * - FD + * - TD + * - OI + * - MI + */ +IL_LIFTER(mov) { + return x86_il_set_op(0, x86_il_get_op(1)); +} + +RzILOpEffect *x86_il_movs_helper(const X86ILIns *ins, ut64 pc, RzAnalysis *analysis, ut8 size) { + if (analysis->bits == 64) { + X86Reg mem_reg1 = X86_REG_RSI; + X86Reg mem_reg2 = X86_REG_RDI; + ut8 mem_size = 64; + + /* Address override prefix: 67H */ + if (ins->structure->prefix[3]) { + mem_reg1 = X86_REG_ESI; + mem_reg2 = X86_REG_EDI; + mem_size = 32; + } + + /* Cast to 64 if necessary (needed when address override prefix present) */ + RzILOpPure *val = LOADW(size, (mem_size == 64 ? x86_il_get_reg(mem_reg1) : UNSIGNED(64, x86_il_get_reg(mem_reg1)))); + RzILOpEffect *inc = SEQ2(x86_il_set_reg(mem_reg1, ADD(x86_il_get_reg(mem_reg1), UN(mem_size, size / BITS_PER_BYTE))), x86_il_set_reg(mem_reg2, ADD(x86_il_get_reg(mem_reg2), UN(mem_size, size / BITS_PER_BYTE)))); + RzILOpEffect *dec = SEQ2(x86_il_set_reg(mem_reg1, SUB(x86_il_get_reg(mem_reg1), UN(mem_size, size / BITS_PER_BYTE))), x86_il_set_reg(mem_reg2, SUB(x86_il_get_reg(mem_reg2), UN(mem_size, size / BITS_PER_BYTE)))); + RzILOpEffect *update = BRANCH(VARG(EFLAGS(DF)), dec, inc); + + return SEQ2(STOREW((mem_size == 64 ? x86_il_get_reg(mem_reg2) : UNSIGNED(64, x86_il_get_reg(mem_reg2))), val), update); + + } else { + X86Reg src_reg = X86_REG_ESI; + X86Reg dst_reg = X86_REG_EDI; + ut8 mem_size = 32; + + /* Address override prefix: 67H */ + if (analysis->bits == 16 || ins->structure->prefix[3]) { + src_reg = X86_REG_SI; + dst_reg = X86_REG_DI; + mem_size = 16; + } + + X86Mem src_mem = { + .base = src_reg, + .disp = 0, + .index = X86_REG_INVALID, + .scale = 1, + .segment = X86_REG_DS + }; + X86Mem dst_mem = { + .base = dst_reg, + .disp = 0, + .index = X86_REG_INVALID, + .scale = 1, + .segment = X86_REG_ES + }; + + RzILOpEffect *inc = SEQ2(x86_il_set_reg(src_reg, ADD(x86_il_get_reg(src_reg), UN(mem_size, size / BITS_PER_BYTE))), x86_il_set_reg(dst_reg, ADD(x86_il_get_reg(dst_reg), UN(mem_size, size / BITS_PER_BYTE)))); + RzILOpEffect *dec = SEQ2(x86_il_set_reg(src_reg, SUB(x86_il_get_reg(src_reg), UN(mem_size, size / BITS_PER_BYTE))), x86_il_set_reg(dst_reg, SUB(x86_il_get_reg(dst_reg), UN(mem_size, size / BITS_PER_BYTE)))); + RzILOpEffect *update = BRANCH(VARG(EFLAGS(DF)), dec, inc); + + /* No need for casting memaddr here since the casting will be done while calculating the segmented address */ + return SEQ2(x86_il_set_mem(dst_mem, LOADW(size, x86_il_get_memaddr(src_mem))), update); + } +} + +/** + * MOVSB + * Move string byte + * No operands + */ +IL_LIFTER(movsb) { + return x86_il_movs_helper(ins, pc, analysis, 8); +} + +/** + * MOVSW + * Move string word + * No operands + */ +IL_LIFTER(movsw) { + return x86_il_movs_helper(ins, pc, analysis, 16); +} + +/** + * MOVSD + * Move string dword + * No operands + */ +IL_LIFTER(movsd) { + return x86_il_movs_helper(ins, pc, analysis, 32); +} + +/** + * MOVSQ + * Move string quadword + * No operands + */ +IL_LIFTER(movsq) { + return x86_il_movs_helper(ins, pc, analysis, 64); +} + +/** + * MUL + * Unsigned multiply + * Encoding: M + */ +IL_LIFTER(mul) { + RzILOpPure *op = UNSIGNED(ins->structure->operands[0].size * BITS_PER_BYTE * 2, x86_il_get_op(0)); + RzILOpEffect *true_cond = SEQ2(SETG(EFLAGS(OF), IL_FALSE), SETG(EFLAGS(CF), IL_FALSE)); + RzILOpEffect *false_cond = SEQ2(SETG(EFLAGS(OF), IL_TRUE), SETG(EFLAGS(CF), IL_TRUE)); + + switch (ins->structure->operands[0].size) { + case 1: { + RzILOpEffect *set = SETL("_mul", MUL(UNSIGNED(16, x86_il_get_reg(X86_REG_AL)), op)); + RzILOpEffect *ax = x86_il_set_reg(X86_REG_AX, VARL("_mul")); + RzILOpEffect *flags = BRANCH(IS_ZERO(SHIFTR0(VARL("_mul"), U8(8))), true_cond, false_cond); + + return SEQ3(set, ax, flags); + } + case 2: { + RzILOpEffect *set = SETL("_mul", MUL(UNSIGNED(32, x86_il_get_reg(X86_REG_AX)), op)); + RzILOpEffect *dx = x86_il_set_reg(X86_REG_DX, UNSIGNED(16, SHIFTR0(VARL("_mul"), U8(16)))); + RzILOpEffect *ax = x86_il_set_reg(X86_REG_AX, UNSIGNED(16, VARL("_mul"))); + RzILOpEffect *flags = BRANCH(IS_ZERO(SHIFTR0(VARL("_mul"), U8(16))), true_cond, false_cond); + + return SEQ4(set, dx, ax, flags); + } + case 4: { + RzILOpEffect *set = SETL("_mul", MUL(UNSIGNED(64, x86_il_get_reg(X86_REG_EAX)), op)); + RzILOpEffect *edx = x86_il_set_reg(X86_REG_EDX, UNSIGNED(32, SHIFTR0(VARL("_mul"), U8(32)))); + RzILOpEffect *eax = x86_il_set_reg(X86_REG_EAX, UNSIGNED(32, VARL("_mul"))); + RzILOpEffect *flags = BRANCH(IS_ZERO(SHIFTR0(VARL("_mul"), U8(32))), true_cond, false_cond); + + return SEQ4(set, edx, eax, flags); + } + case 8: { + RzILOpEffect *set = SETL("_mul", MUL(UNSIGNED(128, x86_il_get_reg(X86_REG_RAX)), op)); + RzILOpEffect *rdx = x86_il_set_reg(X86_REG_RDX, UNSIGNED(64, SHIFTR0(VARL("_mul"), U8(64)))); + RzILOpEffect *rax = x86_il_set_reg(X86_REG_RAX, UNSIGNED(64, VARL("_mul"))); + RzILOpEffect *flags = BRANCH(IS_ZERO(SHIFTR0(VARL("_mul"), U8(64))), true_cond, false_cond); + + return SEQ4(set, rdx, rax, flags); + } + } + + rz_warn_if_reached(); + return NULL; +} + +/** + * NEG + * Two's complement negation + * Encoding: M + */ +IL_LIFTER(neg) { + RzILOpEffect *op = SETL("_op", x86_il_get_op(0)); + RzILOpEffect *cf = BRANCH(IS_ZERO(VARL("_op")), SETG(EFLAGS(CF), IL_FALSE), SETG(EFLAGS(CF), IL_TRUE)); + RzILOpEffect *neg = x86_il_set_op(0, NEG(VARL("_op"))); + + return SEQ3(op, cf, neg); +} + +/** + * NOP + * No operation + * Encoding: + * - ZO (zero operands) + * - M (multi-byte nop) + */ +IL_LIFTER(nop) { + return NOP(); +} + +/** + * NOT + * One's complement negation + * Encoding: M + */ +IL_LIFTER(not ) { + return x86_il_set_op(0, LOGNOT(x86_il_get_op(0))); +} + +/** + * OR + * Logical inclusive or + * Encoding: + * - I + * - MI + * - MR + * - RM + */ +IL_LIFTER(or) { + RzILOpPure *op1 = x86_il_get_op(0); + RzILOpPure *op2 = x86_il_get_op(1); + RzILOpEffect * or = SETL("_or", LOGOR(op1, op2)); + + RzILOpEffect *set_dest = x86_il_set_op(0, VARL("_or")); + RzILOpEffect *clear_of = SETG(EFLAGS(OF), IL_FALSE); + RzILOpEffect *clear_cf = SETG(EFLAGS(CF), IL_FALSE); + RzILOpEffect *set_res_flags = x86_il_set_result_flags(VARL("_or")); + + return SEQ5(or, set_dest, clear_of, clear_cf, set_res_flags); +} + +/** + * OUT + * Output to port + * Encodings: I, ZO + */ +IL_LIFTER(out) { + /* It just jumps to an empty goto label "port" + Also need an EMPTY() instruction after it to denote + the end of analysis and restart all IL analysis */ + return SEQ2(GOTO("port"), EMPTY()); +} + +typedef struct pop_helper_t { + RzILOpPure *val; + RzILOpEffect *eff; +} PopHelper; + +PopHelper x86_pop_helper_bits(unsigned int op_size, unsigned int bitness) { + X86Mem stack_mem; + /* The correct register will automatically be chosen if we use RSP */ + stack_mem.base = X86_REG_RSP; + stack_mem.disp = 0; + stack_mem.index = X86_REG_INVALID; + stack_mem.scale = 1; + stack_mem.segment = X86_REG_SS; + + PopHelper ret; + + ret.val = LOADW(op_size * BITS_PER_BYTE, x86_il_get_memaddr_bits(stack_mem, bitness)); + ret.eff = x86_il_set_reg_bits(X86_REG_RSP, ADD(x86_il_get_reg_bits(X86_REG_RSP, bitness, 0), UN(bitness, op_size)), bitness); + + return ret; +} + +#define x86_pop_helper(op_size) x86_pop_helper_bits(op_size, analysis->bits) + +/** + * POP + * Pop a value from the stack + * Encoding: + * - M + * - O + * - ZO + */ +IL_LIFTER(pop) { + /* Ideally, we should use the stack size instead of the address size (analysis->bits), + but there seems to be no way to do that using Capstone */ + /* Also, it is very rare to use have a different stack size and address size */ + PopHelper pop = x86_pop_helper(ins->structure->operands[0].size); + RzILOpEffect *copy = x86_il_set_op(0, pop.val); + + return SEQ2(copy, pop.eff); +} + +/** + * POPF + * Pop stack into FLAGS register (16 bits) + * Encoding: ZO + */ +IL_LIFTER(popf) { + /* This is not _completely_ accurate, but it is good enough for our purposes */ + PopHelper pop = x86_pop_helper(2 /* BYTES */); + return SEQ2(x86_il_set_flags(pop.val, 16), pop.eff); +} + +/** + * POPFD + * Pop stack into EFLAGS register (32 bits) + * Encoding: ZO + */ +IL_LIFTER(popfd) { + /* Functionally the same as POPF IL */ + PopHelper pop = x86_pop_helper(4 /* BYTES */); + return SEQ2(x86_il_set_flags(pop.val, 32), pop.eff); +} + +/** + * POPFQ + * Pop stack into RFLAGS register (64 bits) + * Encoding: ZO + */ +IL_LIFTER(popfq) { + /* Functionally the same as POPF IL */ + PopHelper pop = x86_pop_helper(8 /* BYTES */); + return SEQ2(x86_il_set_flags(pop.val, 64), pop.eff); +} + +RzILOpEffect *x86_push_helper_impl(RzILOpPure *val, unsigned int user_op_size, unsigned int bitness, const X86ILIns *ins) { + X86Mem stack_mem; + /* The correct register will automatically be chosen if we use RSP */ + stack_mem.base = X86_REG_RSP; + stack_mem.disp = 0; + stack_mem.index = X86_REG_INVALID; + stack_mem.scale = 1; + stack_mem.segment = X86_REG_SS; + + unsigned int dflag = user_op_size; + unsigned int op_size; + unsigned int stack_size = bitness / BITS_PER_BYTE; + + if (ins) { + if (bitness == 64) { + dflag = ins->structure->rex ? 8 : ins->structure->prefix[2] ? 2 + : 4; /* in bytes */ + stack_size = 8; /* in bytes */ + } else { + /* We use the other operand and address size if the prefix is set */ + if ((bitness == 32) ^ ins->structure->prefix[2]) { + dflag = 4; + } else { + dflag = 2; + } + + stack_size = 4; + } + } + + if (bitness == 64) { + op_size = (dflag == 2) ? 2 : 8; + } else { + op_size = dflag; + } + + RzILOpEffect *ret = STOREW(x86_il_get_memaddr_bits(stack_mem, bitness), UNSIGNED(op_size * BITS_PER_BYTE, val)); + ret = SEQ2(x86_il_set_reg_bits(X86_REG_RSP, SUB(x86_il_get_reg_bits(X86_REG_RSP, bitness, 0), UN(bitness, stack_size)), bitness), ret); + + return ret; +} + +#define x86_push_helper(val, op_size) x86_push_helper_impl(val, op_size, analysis->bits, NULL) + +/** + * CALL + * Perform a function call + * Encoding: D, M + */ +IL_LIFTER(call) { + /* + * The following implementation is not accurate, since there are many nitty-gritties involved. + * Like whether the call is a near or far call, absolute or relative call, etc. + * Implementing it accurately will require exceptions, task switching, + * shadow stack, CPU internal flags, segmentation support + * Just pushing the current program counter is a good approcimation for now + * shadow stack, CPU internal flags, segmentation support + * Just pushing the current program counter is a good approcimation for now + * We also need to push the code segment register in case 16 and 32 bit modes. + */ + + if (analysis->bits == 64) { + return x86_push_helper(U64(pc), 2); + } else { + return SEQ4(SETL("_cs", UNSIGNED(analysis->bits, x86_il_get_reg(X86_REG_CS))), x86_push_helper(VARL("_cs"), analysis->bits / BITS_PER_BYTE), SETL("_pc", UN(analysis->bits, pc)), x86_push_helper(VARL("_pc"), analysis->bits / BITS_PER_BYTE)); + } +} + +/** + * PUSH + * Push value on the stack + * Encoding: + * - M + * - O + * - I + * - ZO + */ +IL_LIFTER(push) { + return x86_push_helper_impl(x86_il_get_op(0), ins->structure->operands->size, analysis->bits, ins); +} + +/** + * PUSHF + * Push FLAGS register onto the stack (16 bits) + * Encoding: ZO + */ +IL_LIFTER(pushf) { + return x86_push_helper(x86_il_get_flags(16), 2); +} + +/** + * PUSHFD + * Push EFLAGS register onto the stack (32 bits) + * Encoding: ZO + */ +IL_LIFTER(pushfd) { + return x86_push_helper(x86_il_get_flags(32), 4); +} + +/** + * PUSHFQ + * Push RFLAGS register onto the stack (64 bits) + * Encoding: ZO + */ +IL_LIFTER(pushfq) { + return x86_push_helper(x86_il_get_flags(64), 8); +} + +/** + * PUSHA + * Push all general-purpose registers (16-bits) + * Encoding: ZO + */ +IL_LIFTER(pushaw) { + if (analysis->bits != 16) { + return NULL; + } + + RzILOpEffect *temp = SETL("_sp", x86_il_get_reg(X86_REG_SP)); + RzILOpEffect *push = x86_push_helper(x86_il_get_reg(X86_REG_AX), 2); + push = SEQ2(push, x86_push_helper(x86_il_get_reg(X86_REG_CX), 2)); + push = SEQ2(push, x86_push_helper(x86_il_get_reg(X86_REG_DX), 2)); + push = SEQ2(push, x86_push_helper(x86_il_get_reg(X86_REG_BX), 2)); + push = SEQ2(push, x86_push_helper(VARL("_sp"), 2)); + push = SEQ2(push, x86_push_helper(x86_il_get_reg(X86_REG_BP), 2)); + push = SEQ2(push, x86_push_helper(x86_il_get_reg(X86_REG_SI), 2)); + push = SEQ2(push, x86_push_helper(x86_il_get_reg(X86_REG_DI), 2)); + + return SEQ2(temp, push); +} + +/** + * PUSHAD + * Push all general-purpose registers (32-bits) + * Encoding: ZO + */ +IL_LIFTER(pushal) { + if (analysis->bits != 32) { + return NULL; + } + + RzILOpEffect *temp = SETL("_esp", x86_il_get_reg(X86_REG_ESP)); + RzILOpEffect *push = x86_push_helper(x86_il_get_reg(X86_REG_EAX), 4); + push = SEQ2(push, x86_push_helper(x86_il_get_reg(X86_REG_ECX), 4)); + push = SEQ2(push, x86_push_helper(x86_il_get_reg(X86_REG_EDX), 4)); + push = SEQ2(push, x86_push_helper(x86_il_get_reg(X86_REG_EBX), 4)); + push = SEQ2(push, x86_push_helper(VARL("_esp"), 4)); + push = SEQ2(push, x86_push_helper(x86_il_get_reg(X86_REG_EBP), 4)); + push = SEQ2(push, x86_push_helper(x86_il_get_reg(X86_REG_ESI), 4)); + push = SEQ2(push, x86_push_helper(x86_il_get_reg(X86_REG_EDI), 4)); + + return SEQ2(temp, push); +} + +#define RCX_MACRO() \ + unsigned int size = ins->structure->operands[0].size; \ + RzILOpEffect *dest = SETL("_dest", x86_il_get_op(0)); \ + RzILOpEffect *temp_count = NULL, *cnt_masked = NULL; \ + ut8 tmp_count_size = 0; \ + switch (size) { \ + case 1: \ + temp_count = SETL("_tmp_cnt", MOD(UNSIGNED(5, x86_il_get_op(1)), UN(5, 9))); \ + cnt_masked = SETL("_cnt_mask", UNSIGNED(5, x86_il_get_op(1))); \ + tmp_count_size = 5; \ + break; \ + case 2: \ + temp_count = SETL("_tmp_cnt", MOD(UNSIGNED(5, x86_il_get_op(1)), UN(5, 17))); \ + cnt_masked = SETL("_cnt_mask", UNSIGNED(5, x86_il_get_op(1))); \ + tmp_count_size = 5; \ + break; \ + case 4: \ + temp_count = SETL("_tmp_cnt", UNSIGNED(5, x86_il_get_op(1))); \ + cnt_masked = SETL("_cnt_mask", UNSIGNED(5, x86_il_get_op(1))); \ + tmp_count_size = 5; \ + break; \ + case 8: \ + temp_count = SETL("_tmp_cnt", UNSIGNED(6, x86_il_get_op(1))); \ + cnt_masked = SETL("_cnt_mask", UNSIGNED(6, x86_il_get_op(1))); \ + tmp_count_size = 6; \ + break; \ + default: \ + rz_warn_if_reached(); \ + } + +/** + * RCL + * Rotate left, with carry + * Encoding: MI, M1, MC + */ +IL_LIFTER(rcl) { + RCX_MACRO(); + + RzILOpBool *cond = NON_ZERO(VARL("_tmp_cnt")); + RzILOpEffect *repeat = SETL("_tmp_cf", MSB(VARL("_dest"))); + repeat = SEQ2(repeat, SETL("_dest", ADD(SHIFTL0(VARL("_dest"), U8(1)), x86_bool_to_bv(VARG(EFLAGS(CF)), BITS_PER_BYTE * size)))); + repeat = SEQ2(repeat, SETG(EFLAGS(CF), VARL("_tmp_cf"))); + repeat = SEQ2(repeat, SETL("_tmp_cnt", SUB(VARL("_tmp_cnt"), UN(tmp_count_size, 1)))); + + RzILOpEffect *ret = SEQ4(dest, temp_count, cnt_masked, REPEAT(cond, repeat)); + + RzILOpBool *if_cond = EQ(VARL("_cnt_mask"), UN(tmp_count_size, 1)); + RzILOpEffect *true_eff = SETG(EFLAGS(OF), XOR(MSB(VARL("_dest")), VARG(EFLAGS(CF)))); + RzILOpEffect *set_dest = x86_il_set_op(0, VARL("_dest")); + + return SEQ3(ret, BRANCH(if_cond, true_eff, NULL), set_dest); +} + +/** + * RCR + * Rotate right, with carry + * Encoding: MI, M1, MC + */ +IL_LIFTER(rcr) { + RCX_MACRO(); + + RzILOpBool *if_cond = EQ(VARL("_cnt_mask"), UN(tmp_count_size, 1)); + RzILOpEffect *true_eff = SETG(EFLAGS(OF), XOR(MSB(VARL("_dest")), VARG(EFLAGS(CF)))); + + RzILOpBool *cond = NON_ZERO(VARL("_tmp_cnt")); + RzILOpEffect *repeat = SETL("_tmp_cf", LSB(VARL("_dest"))); + repeat = SEQ2(repeat, SETL("_dest", ADD(SHIFTR0(VARL("_dest"), U8(1)), SHIFTL0(x86_bool_to_bv(VARG(EFLAGS(CF)), BITS_PER_BYTE * size), U8(size))))); + repeat = SEQ2(repeat, SETG(EFLAGS(CF), VARL("_tmp_cf"))); + repeat = SEQ2(repeat, SETL("_tmp_cnt", SUB(VARL("_tmp_cnt"), UN(tmp_count_size, 1)))); + + RzILOpEffect *set_dest = x86_il_set_op(0, VARL("_dest")); + RzILOpEffect *ret = SEQ6(dest, temp_count, cnt_masked, BRANCH(if_cond, true_eff, NULL), REPEAT(cond, repeat), set_dest); + + return ret; +} + +#undef RCX_MACRO + +#define ROX_MACRO() \ + unsigned int size = ins->structure->operands[0].size; \ + unsigned int cnt_size = ins->structure->operands[1].size * BITS_PER_BYTE; \ + RzILOpEffect *dest = SETL("_dest", x86_il_get_op(0)); \ + RzILOpEffect *count_mask = NULL; \ + if (size == 64) { \ + count_mask = SETL("_cnt_mask", UN(ins->structure->operands[1].size * BITS_PER_BYTE, 0x3f)); \ + } else { \ + count_mask = SETL("_cnt_mask", UN(ins->structure->operands[1].size * BITS_PER_BYTE, 0x1f)); \ + } \ + RzILOpEffect *count = SETL("_cnt", x86_il_get_op(1)); \ + RzILOpEffect *masked = SETL("_masked", LOGAND(VARL("_cnt_mask"), VARL("_cnt"))); \ + RzILOpEffect *temp_count = SETL("_tmp_cnt", MOD(VARL("_masked"), UN(cnt_size, size))); + +/** + * ROL + * Rotate left + * Encoding: MI, M1, MC + */ +IL_LIFTER(rol) { + ROX_MACRO(); + + RzILOpBool *cond = NON_ZERO(VARL("_tmp_cnt")); + RzILOpEffect *repeat = SETL("_tmp_cf", MSB(VARL("_dest"))); + repeat = SEQ2(repeat, SETL("_dest", ADD(SHIFTL0(VARL("_dest"), U8(1)), x86_bool_to_bv(VARL("_tmp_cf"), BITS_PER_BYTE * size)))); + repeat = SEQ2(repeat, SETL("_tmp_cnt", SUB(VARL("_tmp_cnt"), UN(cnt_size, 1)))); + + RzILOpBool *if_cond1 = NON_ZERO(VARL("_masked")); + RzILOpEffect *true_eff1 = SETG(EFLAGS(CF), LSB(VARL("_dest"))); + + RzILOpBool *if_cond2 = EQ(VARL("_masked"), UN(cnt_size, 1)); + RzILOpEffect *true_eff2 = SETG(EFLAGS(OF), XOR(MSB(VARL("_dest")), VARG(EFLAGS(CF)))); + + RzILOpEffect *set_dest = x86_il_set_op(0, VARL("_dest")); + RzILOpEffect *ret = SEQ9(dest, count_mask, count, masked, temp_count, REPEAT(cond, repeat), BRANCH(if_cond1, true_eff1, NULL), BRANCH(if_cond2, true_eff2, NULL), set_dest); + + return ret; +} + +/** + * ROR + * Rotate right + * Encoding: MI, M1, MC + */ +IL_LIFTER(ror) { + ROX_MACRO(); + + RzILOpBool *cond = NON_ZERO(VARL("_tmp_cnt")); + RzILOpEffect *repeat = SETL("_tmp_cf", LSB(VARL("_dest"))); + repeat = SEQ2(repeat, SETL("_dest", ADD(SHIFTR0(VARL("_dest"), U8(1)), SHIFTL0(x86_bool_to_bv(VARL("_tmp_cf"), BITS_PER_BYTE * size), U8(size))))); + repeat = SEQ2(repeat, SETL("_tmp_cnt", SUB(VARL("_tmp_cnt"), UN(cnt_size, 1)))); + + RzILOpBool *if_cond1 = NON_ZERO(VARL("_masked")); + RzILOpEffect *true_eff1 = SETG(EFLAGS(CF), MSB(VARL("_dest"))); + + RzILOpBool *if_cond2 = EQ(VARL("_masked"), UN(cnt_size, 1)); + RzILOpEffect *true_eff2 = SETG(EFLAGS(OF), XOR(MSB(VARL("_dest")), MSB(SHIFTL0(VARL("_dest"), U8(1))))); + + RzILOpEffect *set_dest = x86_il_set_op(0, VARL("_dest")); + RzILOpEffect *ret = SEQ9(dest, count_mask, count, masked, temp_count, REPEAT(cond, repeat), BRANCH(if_cond1, true_eff1, NULL), BRANCH(if_cond2, true_eff2, NULL), set_dest); + + return ret; +} + +#undef ROX_MACRO + +/** + * RET + * Return (near pointer) + * Encoding: ZO, I + * Most modern x86-32 and x86-64 programs use this return instruction + */ +IL_LIFTER(ret) { + PopHelper ph = x86_pop_helper(analysis->bits / BITS_PER_BYTE /* BYTES */); + RzILOpEffect *ret = ph.eff; + /* We can use RSP, and the correct stack pointer will be resolved depending on bitness */ + ret = SEQ2(ret, x86_il_set_reg(X86_REG_RSP, ph.val)); + + if (ins->structure->op_count == 1) { + /* Immediate operand (Encondig: I) */ + ret = SEQ2(ret, x86_il_set_reg(X86_REG_RSP, ADD(x86_il_get_reg(X86_REG_RSP), UN(analysis->bits, ins->structure->operands[0].imm)))); + } + + return ret; +} + +// /** +// * RETF +// * Return far pointer +// * Encoding: ZO, I +// * Rarely found in modern programs +// */ +// IL_LIFTER(retf) { +// /* Unimplemented: Too rare and cumbersome to implement */ +// return EMPTY(); +// } + +// /** +// * RETFQ +// * Return far pointer (size: qword) +// * Encoding: ZO, I +// * Rarely found in modern programs +// */ +// IL_LIFTER(retfq) { +// /* Unimplemented: Too rare and cumbersome to implement */ +// return EMPTY(); +// } + +/** + * SAHF + * Store AH into FLAGS + * Encoding: ZO + */ +IL_LIFTER(sahf) { + return x86_il_set_flags(x86_il_get_reg(X86_REG_AH), 8); +} + +#define SHIFT_MACRO() \ + RzILOpEffect *count = SETL("_cnt", x86_il_get_op(1)); \ + RzILOpEffect *count_mask = NULL; \ + unsigned int count_size = ins->structure->operands[1].size * BITS_PER_BYTE; \ + if (analysis->bits) { \ + count_mask = SETL("_cnt_mask", UN(count_size, 0x3f)); \ + } else { \ + count_mask = SETL("_cnt_mask", UN(count_size, 0x1f)); \ + } \ + RzILOpEffect *masked_count = SETL("_masked", LOGAND(VARL("_cnt"), VARL("_cnt_mask"))); \ + RzILOpEffect *temp_count = SETL("_tmp_cnt", VARL("_masked")); \ + RzILOpEffect *dest = SETL("_dest", x86_il_get_op(0)); \ + RzILOpEffect *temp_dest = SETL("_tmp_dest", VARL("_dest")); \ + RzILOpBool *while_cond = NON_ZERO(VARL("_tmp_cnt")); \ + RzILOpEffect *ret = SEQ6(count, count_mask, masked_count, temp_count, dest, temp_dest); + +/** + * SAL + * Shift arithmetically left (signed shift left) + * Encoding: M1, MC, MI + * (Functionally the same as SHL) + */ +IL_LIFTER(sal) { + SHIFT_MACRO(); + + RzILOpEffect *loop_body = SETG(EFLAGS(CF), MSB(VARL("_dest"))); + loop_body = SEQ2(loop_body, SETL("_dest", SHIFTL0(VARL("_dest"), U8(1)))); + loop_body = SEQ2(loop_body, SETL("_tmp_cnt", SUB(VARL("_tmp_cnt"), UN(count_size, 1)))); + + ret = SEQ2(ret, REPEAT(while_cond, loop_body)); + + RzILOpBool *cond = EQ(VARL("_masked"), UN(count_size, 1)); + RzILOpEffect *set_overflow = SETG(EFLAGS(OF), XOR(MSB(VARL("_dest")), VARG(EFLAGS(CF)))); + + return SEQ2(ret, BRANCH(cond, set_overflow, NULL)); +} + +/** + * SAR + * Shift arithmetically right (signed shift right) + * Encoding: M1, MC, MI + */ +IL_LIFTER(sar) { + SHIFT_MACRO(); + + RzILOpEffect *loop_body = SETG(EFLAGS(CF), LSB(VARL("_dest"))); + loop_body = SEQ2(loop_body, SETL("_dest", SHIFTRA(VARL("_dest"), U8(1)))); + loop_body = SEQ2(loop_body, SETL("_tmp_cnt", SUB(VARL("_tmp_cnt"), UN(count_size, 1)))); + + ret = SEQ2(ret, REPEAT(while_cond, loop_body)); + + RzILOpBool *cond = EQ(VARL("_masked"), UN(count_size, 1)); + RzILOpEffect *set_overflow = SETG(EFLAGS(OF), IL_FALSE); + + return SEQ2(ret, BRANCH(cond, set_overflow, NULL)); +} + +/** + * SHL + * Shift left (unsigned shift left) + * Encoding: M1, MC, MI + * (Functionally the same as SAL) + */ +IL_LIFTER(shl) { + SHIFT_MACRO(); + + RzILOpEffect *loop_body = SETG(EFLAGS(CF), MSB(VARL("_dest"))); + loop_body = SEQ2(loop_body, SETL("_dest", SHIFTL0(VARL("_dest"), U8(1)))); + loop_body = SEQ2(loop_body, SETL("_tmp_cnt", SUB(VARL("_tmp_cnt"), UN(count_size, 1)))); + + ret = SEQ2(ret, REPEAT(while_cond, loop_body)); + + RzILOpBool *cond = EQ(VARL("_masked"), UN(count_size, 1)); + RzILOpEffect *set_overflow = SETG(EFLAGS(OF), XOR(MSB(VARL("_dest")), VARG(EFLAGS(CF)))); + + return SEQ2(ret, BRANCH(cond, set_overflow, NULL)); +} + +/** + * SHR + * Shift right (unsigned shift left) + * Encoding: M1, MC, MI + */ +IL_LIFTER(shr) { + SHIFT_MACRO(); + + RzILOpEffect *loop_body = SETG(EFLAGS(CF), LSB(VARL("_dest"))); + loop_body = SEQ2(loop_body, SETL("_dest", SHIFTR0(VARL("_dest"), U8(1)))); + loop_body = SEQ2(loop_body, SETL("_tmp_cnt", SUB(VARL("_tmp_cnt"), UN(count_size, 1)))); + + ret = SEQ2(ret, REPEAT(while_cond, loop_body)); + + RzILOpBool *cond = EQ(VARL("_masked"), UN(count_size, 1)); + RzILOpEffect *set_overflow = SETG(EFLAGS(OF), MSB(VARL("_tmp_dest"))); + + return SEQ2(ret, BRANCH(cond, set_overflow, NULL)); +} + +/** + * SBB + * Subtraction with borrow + * DEST = DEST - (SRC + CF) + * Encoding: I, MI, MR, RM + */ +IL_LIFTER(sbb) { + RzILOpEffect *op1 = SETL("_op1", x86_il_get_op(0)); + RzILOpEffect *op2 = SETL("_op2", x86_il_get_op(1)); + RzILOpPure *cf = VARG(EFLAGS(CF)); + + RzILOpEffect *diff = SETL("_diff", SUB(SUB(VARL("_op1"), VARL("_op2")), x86_bool_to_bv(cf, ins->structure->operands[0].size * BITS_PER_BYTE))); + RzILOpEffect *set_dest = x86_il_set_op(0, VARL("_diff")); + RzILOpEffect *set_res_flags = x86_il_set_result_flags(VARL("_diff")); + RzILOpEffect *set_arith_flags = x86_il_set_arithmetic_flags(VARL("_diff"), VARL("_op1"), VARL("_op2"), false); + + return SEQ6(op1, op2, diff, set_dest, set_res_flags, set_arith_flags); +} + +RzILOpEffect *x86_il_scas_helper(const X86ILIns *ins, ut64 pc, RzAnalysis *analysis, ut8 size) { + X86Reg sub_reg; + + switch (size) { + case 8: + sub_reg = X86_REG_AL; + break; + case 16: + sub_reg = X86_REG_AX; + break; + case 32: + sub_reg = X86_REG_EAX; + break; + case 64: + sub_reg = X86_REG_RAX; + break; + default: + rz_warn_if_reached(); + return NULL; + } + + if (analysis->bits == 64) { + X86Reg mem_reg = X86_REG_RDI; + ut8 mem_size = 64; + /* Address override prefix: 67H */ + if (ins->structure->prefix[3]) { + mem_reg = X86_REG_EDI; + mem_size = 32; + } + + /* Cast to 64 if necessary (needed when address override prefix present) */ + RzILOpEffect *src = SETL("_src", LOADW(size, (mem_size == 64 ? x86_il_get_reg(mem_reg) : UNSIGNED(64, x86_il_get_reg(mem_reg))))); + RzILOpEffect *reg = SETL("_reg", x86_il_get_reg(sub_reg)); + RzILOpEffect *temp = SETL("_temp", SUB(VARL("_reg"), VARL("_src"))); + RzILOpEffect *arith_flags = x86_il_set_arithmetic_flags(VARL("_temp"), VARL("_reg"), VARL("_src"), false); + RzILOpEffect *res_flags = x86_il_set_result_flags(VARL("_temp")); + + RzILOpEffect *increment = x86_il_set_reg(mem_reg, ADD(x86_il_get_reg(mem_reg), UN(mem_size, size / BITS_PER_BYTE))); + RzILOpEffect *decrement = x86_il_set_reg(mem_reg, SUB(x86_il_get_reg(mem_reg), UN(mem_size, size / BITS_PER_BYTE))); + + return SEQ6(reg, src, temp, arith_flags, res_flags, BRANCH(VARG(EFLAGS(DF)), decrement, increment)); + } else { + RzILOpEffect *reg = SETL("_reg", x86_il_get_reg(sub_reg)); + + X86Reg mem_reg = X86_REG_EDI; + ut8 mem_size = 32; + /* Check bitness and address override prefix: 67H */ + if (analysis->bits == 16 || ins->structure->prefix[3]) { + mem_reg = X86_REG_DI; + mem_size = 16; + } + + X86Mem src_mem; + src_mem.base = mem_reg; + src_mem.disp = 0; + src_mem.index = X86_REG_INVALID; + src_mem.scale = 1; + src_mem.segment = X86_REG_ES; + + /* No need for casting memaddr here since the casting will be done while calculating the segmented address */ + RzILOpEffect *src = SETL("_src", LOADW(size, x86_il_get_memaddr(src_mem))); + RzILOpEffect *temp = SETL("_temp", SUB(VARL("_reg"), VARL("_src"))); + RzILOpEffect *arith_flags = x86_il_set_arithmetic_flags(VARL("_temp"), VARL("_reg"), VARL("_src"), false); + RzILOpEffect *res_flags = x86_il_set_result_flags(VARL("_temp")); + + RzILOpEffect *increment = x86_il_set_reg(mem_reg, ADD(x86_il_get_reg(mem_reg), UN(mem_size, size / BITS_PER_BYTE))); + RzILOpEffect *decrement = x86_il_set_reg(mem_reg, SUB(x86_il_get_reg(mem_reg), UN(mem_size, size / BITS_PER_BYTE))); + + return SEQ6(reg, src, temp, arith_flags, res_flags, BRANCH(VARG(EFLAGS(DF)), decrement, increment)); + } +} + +/** + * SCASB + * Compare byte string + * ZO + */ +IL_LIFTER(scasb) { + return x86_il_scas_helper(ins, pc, analysis, 8); +} + +/** + * SCASW + * Compare word string + * ZO + */ +IL_LIFTER(scasw) { + return x86_il_scas_helper(ins, pc, analysis, 16); +} + +/** + * SCASD + * Compare dword string + * ZO + */ +IL_LIFTER(scasd) { + return x86_il_scas_helper(ins, pc, analysis, 32); +} + +/** + * SCASQ + * Compare quadword string (only for x86-64) + * ZO + */ +IL_LIFTER(scasq) { + return x86_il_scas_helper(ins, pc, analysis, 64); +} + +/** + * STAC + * Set AC flag + * ZO + */ +IL_LIFTER(stac) { + return SETG(EFLAGS(AC), IL_TRUE); +} + +/** + * STC + * Set carry flag (CF) + * ZO + */ +IL_LIFTER(stc) { + return SETG(EFLAGS(CF), IL_TRUE); +} + +/** + * STD + * Set direction flag (DF) + * ZO + */ +IL_LIFTER(std) { + return SETG(EFLAGS(DF), IL_TRUE); +} + +/** + * STI + * Set interrupt flag (IF) + * ZO + */ +IL_LIFTER(sti) { + return SETG(EFLAGS(IF), IL_TRUE); +} + +RzILOpEffect *x86_il_stos_helper(const X86ILIns *ins, ut64 pc, RzAnalysis *analysis, ut8 size) { + X86Reg store_reg; + + switch (size) { + case 8: + store_reg = X86_REG_AL; + break; + case 16: + store_reg = X86_REG_AX; + break; + case 32: + store_reg = X86_REG_EAX; + break; + case 64: + store_reg = X86_REG_RAX; + break; + default: + rz_warn_if_reached(); + return NULL; + } + + if (analysis->bits == 64) { + X86Reg mem_reg = X86_REG_RDI; + ut8 mem_size = 64; + /* Address override prefix: 67H */ + if (ins->structure->prefix[3]) { + mem_reg = X86_REG_EDI; + mem_size = 32; + } + + /* Cast to 64 if necessary (needed when address override prefix present) */ + RzILOpEffect *store = STOREW((mem_size == 64 ? x86_il_get_reg(mem_reg) : UNSIGNED(64, x86_il_get_reg(mem_reg))), x86_il_get_reg(store_reg)); + + RzILOpEffect *increment = x86_il_set_reg(mem_reg, ADD(x86_il_get_reg(mem_reg), UN(mem_size, size / BITS_PER_BYTE))); + RzILOpEffect *decrement = x86_il_set_reg(mem_reg, SUB(x86_il_get_reg(mem_reg), UN(mem_size, size / BITS_PER_BYTE))); + + return SEQ2(store, BRANCH(VARG(EFLAGS(DF)), decrement, increment)); + } else { + X86Reg mem_reg = X86_REG_EDI; + ut8 mem_size = 32; + /* Check bitness and address override prefix: 67H */ + if (analysis->bits == 16 || ins->structure->prefix[3]) { + mem_reg = X86_REG_DI; + mem_size = 16; + } + + X86Mem src_mem; + src_mem.base = mem_reg; + src_mem.disp = 0; + src_mem.index = X86_REG_INVALID; + src_mem.scale = 1; + src_mem.segment = X86_REG_ES; + + /* No need for casting memaddr here since the casting will be done while calculating the segmented address */ + RzILOpEffect *store = x86_il_set_mem(src_mem, x86_il_get_reg(store_reg)); + RzILOpEffect *increment = x86_il_set_reg(mem_reg, ADD(x86_il_get_reg(mem_reg), UN(mem_size, size / BITS_PER_BYTE))); + RzILOpEffect *decrement = x86_il_set_reg(mem_reg, SUB(x86_il_get_reg(mem_reg), UN(mem_size, size / BITS_PER_BYTE))); + + return SEQ2(store, BRANCH(VARG(EFLAGS(DF)), decrement, increment)); + } +} + +/** + * STOSB + * Store byte in a string + * ZO + */ +IL_LIFTER(stosb) { + return x86_il_stos_helper(ins, pc, analysis, 8); +} + +/** + * STOSW + * Store word in a string + * ZO + */ +IL_LIFTER(stosw) { + + return x86_il_stos_helper(ins, pc, analysis, 16); +} + +/** + * STOSD + * Store dword in a string + * ZO + */ +IL_LIFTER(stosd) { + return x86_il_stos_helper(ins, pc, analysis, 32); +} + +/** + * STOSQ + * Store quadword in a string + * ZO + */ +IL_LIFTER(stosq) { + return x86_il_stos_helper(ins, pc, analysis, 64); +} + +/** + * SUB + * (SUB family of instructions) + * Possible encodings: + * - I + * - MI + * - MR + * - RM + */ +IL_LIFTER(sub) { + RzILOpEffect *op1 = SETL("op1", x86_il_get_op(0)); + RzILOpEffect *op2 = SETL("op2", x86_il_get_op(1)); + RzILOpEffect *sub = SETL("sub", SUB(VARL("op1"), VARL("op2"))); + + RzILOpEffect *set_dest = x86_il_set_op(0, VARL("sub")); + RzILOpEffect *set_res_flags = x86_il_set_result_flags(VARL("sub")); + RzILOpEffect *set_arith_flags = x86_il_set_arithmetic_flags(VARL("sub"), VARL("op1"), VARL("op2"), false); + + return SEQ6(op1, op2, sub, set_dest, set_res_flags, set_arith_flags); +} + +/** + * TEST + * Logical compare (AND) + * Encoding: I, MI, MR + */ +IL_LIFTER(test) { + RzILOpEffect *res = SETL("_res", LOGAND(x86_il_get_op(0), x86_il_get_op(1))); + RzILOpEffect *test = x86_il_set_op(0, VARL("_res")); + RzILOpEffect *res_flags = x86_il_set_result_flags(VARL("_res")); + RzILOpEffect *arith_flags = SEQ2(SETG(EFLAGS(CF), IL_FALSE), SETG(EFLAGS(OF), IL_FALSE)); + + return SEQ4(res, test, res_flags, arith_flags); +} + +/** + * WAIT + * Wait until not busy + * ZO + */ +IL_LIFTER(wait) { + /* NOP seems to be a reasonable implementation */ + return NOP(); +} + +/** + * XCHG + * Exchange data + * Encoding: O, MR, RM + */ +IL_LIFTER(xchg) { + RzILOpEffect *temp = SETL("_temp", x86_il_get_op(0)); + RzILOpEffect *xchg = x86_il_set_op(0, x86_il_get_op(1)); + RzILOpEffect *set_src = x86_il_set_op(1, VARL("_temp")); + + return SEQ3(temp, xchg, set_src); +} + +/** + * XLATB + * Table look-up translation + * Encoding: ZO + */ +IL_LIFTER(xlatb) { + X86Mem mem; + mem.disp = 0; + mem.index = X86_REG_INVALID; + mem.scale = 1; + mem.segment = X86_REG_DS; + mem.base = X86_REG_EBX; + + if (analysis->bits == 64) { + mem.segment = X86_REG_INVALID; + mem.base = X86_REG_RBX; + } else if (analysis->bits == 16) { + mem.base = X86_REG_BX; + } + + return x86_il_set_reg(X86_REG_AL, LOADW(8, ADD(x86_il_get_memaddr(mem), UNSIGNED(analysis->bits, x86_il_get_reg(X86_REG_AL))))); +} + +/** + * XOR + * Logical exclusive OR + * Encodings: I, MI, MR, RM + */ +IL_LIFTER(xor) { + RzILOpPure *op1 = x86_il_get_op(0); + RzILOpPure *op2 = x86_il_get_op(1); + RzILOpEffect * xor = SETL("_xor", LOGXOR(op1, op2)); + + RzILOpEffect *set_dest = x86_il_set_op(0, VARL("_xor")); + RzILOpEffect *clear_of = SETG(EFLAGS(OF), IL_FALSE); + RzILOpEffect *clear_cf = SETG(EFLAGS(CF), IL_FALSE); + RzILOpEffect *set_res_flags = x86_il_set_result_flags(VARL("_xor")); + + return SEQ5(xor, set_dest, clear_of, clear_cf, set_res_flags); +} + +/** + * BOUND + * Check array index against bounds + * Encoding: RM + */ + +IL_LIFTER(bound) { + RzILOpEffect *index = SETL("_index", x86_il_get_op(0)); + + X86Mem mem = ins->structure->operands[1].mem; + RzILOpEffect *lower = SETL("_lower", LOADW(ins->structure->operands[0].size * BITS_PER_BYTE, x86_il_get_memaddr(mem))); + mem.disp += ins->structure->operands[1].size / mem.scale; + RzILOpEffect *upper = SETL("_upper", LOADW(ins->structure->operands[0].size * BITS_PER_BYTE, x86_il_get_memaddr(mem))); + + RzILOpBool *cond = OR(ULT(VARL("_index"), VARL("_lower")), UGT(VARL("_index"), VARL("_upper"))); + + /* Interrupt if out of bounds, NOP otherwise */ + return SEQ4(index, lower, upper, BRANCH(cond, SEQ2(GOTO("int"), EMPTY()), NOP())); +} + +/** + * ENTER + * Make a stack frame for procedure parameters + * Encoding: II + */ +IL_LIFTER(enter) { + RzILOpEffect *alloc_size = SETL("_alloc_sz", UNSIGNED(16, x86_il_get_op(0))); + RzILOpEffect *nesting_level = SETL("_nest_lvl", MOD(UNSIGNED(8, x86_il_get_op(1)), U8(32))); + + /* Will get resolved correctly to the largest SP reg */ + X86Reg sp_reg = X86_REG_RSP; + + /* Default value initialization (useless, but need to avoid warnings) */ + X86Reg bp_reg = X86_REG_RBP; + unsigned short bp_size = analysis->bits / BITS_PER_BYTE; + + switch (analysis->bits) { + case 64: + /* Operand-size override (66H) */ + if (ins->structure->prefix[2]) { + bp_reg = X86_REG_EBP; + bp_size = 4; + } else { + bp_reg = X86_REG_RBP; + bp_size = 8; + } + break; + case 32: + /* Operand-size override (66H) */ + if (ins->structure->prefix[2]) { + bp_reg = X86_REG_BP; + bp_size = 2; + } else { + bp_reg = X86_REG_EBP; + bp_size = 4; + } + break; + case 16: + bp_reg = X86_REG_BP; + bp_size = 2; + break; + default: + rz_warn_if_reached(); + } + + RzILOpEffect *push = x86_push_helper(x86_il_get_reg(bp_reg), bp_size); + RzILOpEffect *frame_temp = SETL("_frame_tmp", x86_il_get_reg(sp_reg)); + + RzILOpEffect *itr = SETL("_itr", U8(1)); + + /* RBP will be dynamically resolved to the correct BP register */ + RzILOpEffect *loop_body = SEQ3(x86_il_set_reg(X86_REG_RBP, SUB(x86_il_get_reg(X86_REG_RBP), UN(analysis->bits, bp_size))), x86_push_helper(LOADW(bp_size * BITS_PER_BYTE, x86_il_get_reg(X86_REG_RBP)), bp_size), SETL("_itr", ADD(VARL("_itr"), U8(1)))); + RzILOpEffect *loop = REPEAT(ULT(VARL("_itr"), VARL("_nest_lvl")), loop_body); + + RzILOpEffect *nesting_lvl1 = x86_push_helper(VARL("_frame_tmp"), bp_size); + + RzILOpEffect *continue_eff = x86_il_set_reg(sp_reg, SUB(x86_il_get_reg(sp_reg), UNSIGNED(analysis->bits, VARL("_alloc_sz")))); + if (bp_size == 2) { + continue_eff = SEQ2(continue_eff, x86_il_set_reg(bp_reg, UNSIGNED(16, UNSIGNED(15, VARL("_frame_tmp"))))); + } else { + continue_eff = SEQ2(continue_eff, x86_il_set_reg(bp_reg, VARL("_frame_tmp"))); + } + + return SEQ6(alloc_size, nesting_level, push, frame_temp, BRANCH(IS_ZERO(VARL("_nest_lvl")), NOP(), SEQ2(BRANCH(UGT(VARL("_nest_lvl"), U8(1)), SEQ2(itr, loop), NOP()), nesting_lvl1)), continue_eff); +} + +/** + * LEAVE + * High level procedure exit + * Encoding: ZO + */ +IL_LIFTER(leave) { + RzILOpEffect *set_sp = x86_il_set_reg(X86_REG_RSP, x86_il_get_reg(X86_REG_RBP)); + + /* Default value initialization (useless, but need to avoid warnings) */ + X86Reg bp_reg = X86_REG_RBP; + unsigned short bp_size = analysis->bits / BITS_PER_BYTE; + + switch (analysis->bits) { + case 64: + /* Operand-size override (66H) */ + if (ins->structure->prefix[2]) { + bp_reg = X86_REG_EBP; + bp_size = 4; + } else { + bp_reg = X86_REG_RBP; + bp_size = 8; + } + break; + case 32: + /* Operand-size override (66H) */ + if (ins->structure->prefix[2]) { + bp_reg = X86_REG_BP; + bp_size = 2; + } else { + bp_reg = X86_REG_EBP; + bp_size = 4; + } + break; + case 16: + bp_reg = X86_REG_BP; + bp_size = 2; + break; + default: + rz_warn_if_reached(); + } + + PopHelper pop = x86_pop_helper(bp_size /* BYTES */); + RzILOpEffect *set_bp = x86_il_set_reg(bp_reg, pop.val); + + return SEQ3(set_sp, pop.eff, set_bp); +} + +typedef RzILOpEffect *(*x86_il_ins)(const X86ILIns *, ut64, RzAnalysis *); + +/** + * \brief RzIL handlers for x86 instructions + */ +static x86_il_ins x86_ins[X86_INS_ENDING] = { + [X86_INS_INVALID] = x86_il_invalid, + [X86_INS_AAA] = x86_il_aaa, + [X86_INS_AAD] = x86_il_aad, + [X86_INS_AAM] = x86_il_aam, + [X86_INS_AAS] = x86_il_aas, + [X86_INS_ADC] = x86_il_adc, + [X86_INS_ADD] = x86_il_add, + [X86_INS_AND] = x86_il_and, + [X86_INS_CALL] = x86_il_call, + [X86_INS_CBW] = x86_il_cbw, + [X86_INS_CLC] = x86_il_clc, + [X86_INS_CLD] = x86_il_cld, + [X86_INS_CLI] = x86_il_cli, + [X86_INS_CMC] = x86_il_cmc, + [X86_INS_CMP] = x86_il_cmp, + [X86_INS_CMPSB] = x86_il_cmpsb, + [X86_INS_CMPSW] = x86_il_cmpsw, + [X86_INS_CMPSD] = x86_il_cmpsd, + [X86_INS_CMPSQ] = x86_il_cmpsq, + [X86_INS_DAA] = x86_il_daa, + [X86_INS_DAS] = x86_il_das, + [X86_INS_DEC] = x86_il_dec, + [X86_INS_DIV] = x86_il_div, + [X86_INS_HLT] = x86_il_hlt, + [X86_INS_IDIV] = x86_il_idiv, + [X86_INS_IMUL] = x86_il_imul, + [X86_INS_IN] = x86_il_in, + [X86_INS_INC] = x86_il_inc, + [X86_INS_INT] = x86_il_int, + [X86_INS_INTO] = x86_il_into, + [X86_INS_IRET] = x86_il_unimpl, + [X86_INS_JA] = x86_il_ja, + [X86_INS_JAE] = x86_il_jae, + [X86_INS_JB] = x86_il_jb, + [X86_INS_JBE] = x86_il_jbe, + [X86_INS_JCXZ] = x86_il_jcxz, + [X86_INS_JECXZ] = x86_il_jecxz, + [X86_INS_JRCXZ] = x86_il_jrcxz, + [X86_INS_JE] = x86_il_je, + [X86_INS_JG] = x86_il_jg, + [X86_INS_JGE] = x86_il_jge, + [X86_INS_JL] = x86_il_jl, + [X86_INS_JLE] = x86_il_jle, + [X86_INS_JNE] = x86_il_jne, + [X86_INS_JNO] = x86_il_jno, + [X86_INS_JNP] = x86_il_jnp, + [X86_INS_JNS] = x86_il_jns, + [X86_INS_JO] = x86_il_jo, + [X86_INS_JP] = x86_il_jp, + [X86_INS_JS] = x86_il_js, + [X86_INS_JMP] = x86_il_jmp, + [X86_INS_LAHF] = x86_il_lahf, + [X86_INS_LDS] = x86_il_lds, + [X86_INS_LEA] = x86_il_lea, + [X86_INS_LES] = x86_il_les, + [X86_INS_LODSB] = x86_il_lodsb, + [X86_INS_LODSW] = x86_il_lodsw, + [X86_INS_LODSD] = x86_il_lodsd, + [X86_INS_LODSQ] = x86_il_lodsq, + [X86_INS_LOOP] = x86_il_loop, + [X86_INS_LOOPE] = x86_il_loope, + [X86_INS_LOOPNE] = x86_il_loopne, + [X86_INS_MOV] = x86_il_mov, + [X86_INS_MOVSB] = x86_il_movsb, + [X86_INS_MOVSW] = x86_il_movsw, + [X86_INS_MOVSD] = x86_il_movsd, + [X86_INS_MOVSQ] = x86_il_movsq, + [X86_INS_MUL] = x86_il_mul, + [X86_INS_NEG] = x86_il_neg, + [X86_INS_NOP] = x86_il_nop, + [X86_INS_NOT] = x86_il_not, + [X86_INS_OR] = x86_il_or, + [X86_INS_OUT] = x86_il_out, + [X86_INS_POP] = x86_il_pop, + [X86_INS_POPF] = x86_il_popf, + [X86_INS_POPFD] = x86_il_popfd, + [X86_INS_POPFQ] = x86_il_popfq, + [X86_INS_PUSH] = x86_il_push, + [X86_INS_PUSHF] = x86_il_pushf, + [X86_INS_PUSHFD] = x86_il_pushfd, + [X86_INS_PUSHFQ] = x86_il_pushfq, + [X86_INS_PUSHAW] = x86_il_pushaw, + [X86_INS_PUSHAL] = x86_il_pushal, + [X86_INS_RCL] = x86_il_rcl, + [X86_INS_RCR] = x86_il_rcr, + [X86_INS_ROL] = x86_il_rol, + [X86_INS_ROR] = x86_il_ror, + [X86_INS_RET] = x86_il_ret, + [X86_INS_RETF] = x86_il_unimpl, + [X86_INS_RETFQ] = x86_il_unimpl, + [X86_INS_SAHF] = x86_il_sahf, + [X86_INS_SAL] = x86_il_sal, + [X86_INS_SAR] = x86_il_sar, + [X86_INS_SHL] = x86_il_shl, + [X86_INS_SHR] = x86_il_shr, + [X86_INS_SBB] = x86_il_sbb, + [X86_INS_SCASB] = x86_il_scasb, + [X86_INS_SCASW] = x86_il_scasw, + [X86_INS_SCASD] = x86_il_scasd, + [X86_INS_SCASQ] = x86_il_scasq, + [X86_INS_STAC] = x86_il_stac, + [X86_INS_STC] = x86_il_stc, + [X86_INS_STD] = x86_il_std, + [X86_INS_STI] = x86_il_sti, + [X86_INS_STOSB] = x86_il_stosb, + [X86_INS_STOSD] = x86_il_stosd, + [X86_INS_STOSQ] = x86_il_stosq, + [X86_INS_STOSW] = x86_il_stosw, + [X86_INS_SUB] = x86_il_sub, + [X86_INS_TEST] = x86_il_test, + [X86_INS_WAIT] = x86_il_wait, + [X86_INS_XCHG] = x86_il_xchg, + [X86_INS_XLATB] = x86_il_xlatb, + [X86_INS_XOR] = x86_il_xor, + [X86_INS_BOUND] = x86_il_bound, + [X86_INS_ENTER] = x86_il_enter, + [X86_INS_INSB] = x86_il_unimpl, + [X86_INS_INSW] = x86_il_unimpl, + [X86_INS_OUTSB] = x86_il_unimpl, + [X86_INS_OUTSW] = x86_il_unimpl, + [X86_INS_LEAVE] = x86_il_leave +}; + +#include + +RZ_IPI bool rz_x86_il_opcode(RZ_NONNULL RzAnalysis *analysis, RZ_NONNULL RzAnalysisOp *aop, ut64 pc, RZ_BORROW RZ_NONNULL const X86ILIns *ins) { + rz_return_val_if_fail(analysis && aop && ins, false); + if (ins->mnem > X86_INS_ENDING) { + RZ_LOG_ERROR("RzIL: x86: Invalid instruction type %d", ins->mnem); + return false; + } + + x86_il_ins lifter = x86_ins[ins->mnem]; + + RzILOpEffect *lifted; + + if (!lifter) { + /* For unimplemented instructions */ + lifter = x86_il_unimpl; + } + lifted = lifter(ins, pc, analysis); + + aop->il_op = lifted; + return true; +} + +RZ_IPI RzAnalysisILConfig *rz_x86_il_config(RZ_NONNULL RzAnalysis *analysis) { + rz_return_val_if_fail(analysis, NULL); + + RzAnalysisILConfig *r = rz_analysis_il_config_new(analysis->bits, analysis->big_endian, analysis->bits); + + switch (analysis->bits) { + case 16: + r->reg_bindings = x86_bound_regs_16; + break; + case 32: + r->reg_bindings = x86_bound_regs_32; + break; + case 64: + r->reg_bindings = x86_bound_regs_64; + break; + default: + rz_warn_if_reached(); + } + + RzILEffectLabel *int_label = rz_il_effect_label_new("int", EFFECT_LABEL_SYSCALL); + int_label->hook = label_int; + rz_analysis_il_config_add_label(r, int_label); + RzILEffectLabel *halt_label = rz_il_effect_label_new("halt", EFFECT_LABEL_SYSCALL); + halt_label->hook = label_halt; + RzILEffectLabel *port_label = rz_il_effect_label_new("port", EFFECT_LABEL_SYSCALL); + port_label->hook = label_port; + + rz_analysis_il_config_add_label(r, halt_label); + + return r; +} diff --git a/librz/analysis/arch/x86/x86_il.h b/librz/analysis/arch/x86/x86_il.h new file mode 100644 index 0000000000..ba754bb94b --- /dev/null +++ b/librz/analysis/arch/x86/x86_il.h @@ -0,0 +1,29 @@ +// SPDX-FileCopyrightText: 2022 Dhruv Maroo +// SPDX-License-Identifier: LGPL-3.0-only + +#ifndef RZIL_ANALYSIS_X86_IL_H +#define RZIL_ANALYSIS_X86_IL_H + +#include +#include +#include +#include + +#define BITS_PER_BYTE 8 +#define GPR_FAMILY_COUNT 10 + +typedef x86_reg X86Reg; +typedef cs_x86_op X86Op; +typedef x86_op_mem X86Mem; +typedef cs_x86 X86Ins; +typedef x86_insn X86InsMnem; + +typedef struct x86_il_instruction_t { + const X86Ins *structure; + X86InsMnem mnem; +} X86ILIns; + +RZ_IPI bool rz_x86_il_opcode(RZ_NONNULL RzAnalysis *analysis, RZ_NONNULL RzAnalysisOp *aop, ut64 pc, RZ_BORROW RZ_NONNULL const X86ILIns *ins); +RZ_IPI RzAnalysisILConfig *rz_x86_il_config(RZ_NONNULL RzAnalysis *analysis); + +#endif /* RZIL_ANALYSIS_X86_IL_H */ diff --git a/librz/analysis/meson.build b/librz/analysis/meson.build index a357aa16c7..dc7e3a210d 100644 --- a/librz/analysis/meson.build +++ b/librz/analysis/meson.build @@ -165,6 +165,7 @@ rz_analysis_sources = [ 'arch/ppc/ppc_il_ops.c', 'arch/ppc/ppc_il_flag_ops.c', 'arch/sh/sh_il.c', + 'arch/x86/x86_il.c', '../asm/arch/amd29k/amd29k.c', '../asm/arch/avr/disassembler.c', '../asm/arch/cil/cil_dis.c', diff --git a/librz/analysis/p/analysis_x86_cs.c b/librz/analysis/p/analysis_x86_cs.c index bb5b92e82c..92c8693313 100644 --- a/librz/analysis/p/analysis_x86_cs.c +++ b/librz/analysis/p/analysis_x86_cs.c @@ -5,6 +5,7 @@ #include #include #include +#include "../arch/x86/x86_il.h" #if 0 CYCLES: @@ -3214,8 +3215,16 @@ static int analop(RzAnalysis *a, RzAnalysisOp *op, ut64 addr, const ut8 *buf, in op_fillval(a, op, &ctx->handle, ctx->insn, mode); } } - //#if X86_GRP_PRIVILEGE>0 + if (ctx->insn) { + // x86 RzIL uplifting + X86ILIns x86_il_ins = { + .structure = &ctx->insn->detail->x86, + .mnem = ctx->insn->id + }; + rz_x86_il_opcode(a, op, addr, &x86_il_ins); + + //#if X86_GRP_PRIVILEGE>0 #if HAVE_CSGRP_PRIVILEGE if (cs_insn_group(ctx->handle, ctx->insn, X86_GRP_PRIVILEGE)) { op->family = RZ_ANALYSIS_OP_FAMILY_PRIV; @@ -3296,15 +3305,15 @@ static char *get_reg_profile(RzAnalysis *analysis) { "seg es .16 58 0\n" "gpr flags .16 56 0\n" "flg cf .1 .448 0\n" - "flg pf .1 .449 0\n" - "flg af .1 .450 0\n" - "flg zf .1 .451 0\n" - "flg sf .1 .452 0\n" - "flg tf .1 .453 0\n" - "flg if .1 .454 0\n" - "flg df .1 .455 0\n" - "flg of .1 .456 0\n" - "flg rf .1 .457 0\n"; + "flg pf .1 .450 0\n" + "flg af .1 .452 0\n" + "flg zf .1 .454 0\n" + "flg sf .1 .455 0\n" + "flg tf .1 .456 0\n" + "flg if .1 .457 0\n" + "flg df .1 .458 0\n" + "flg of .1 .459 0\n" + "flg nt .1 .462 0\n"; #if 0 "drx dr0 .32 0 0\n" "drx dr1 .32 4 0\n" @@ -3355,11 +3364,18 @@ static char *get_reg_profile(RzAnalysis *analysis) { "gpr bp .16 20 0\n" "gpr eip .32 48 0\n" "gpr ip .16 48 0\n" + "seg xds .32 28 0\n" + "seg ds .16 28 0\n" + "seg xes .32 32 0\n" + "seg es .16 32 0\n" "seg xfs .32 36 0\n" + "seg fs .16 36 0\n" "seg xgs .32 40 0\n" + "seg gs .16 40 0\n" + "seg xss .32 64 0\n" + "seg ss .16 64 0\n" "seg xcs .32 52 0\n" "seg cs .16 52 0\n" - "seg xss .32 52 0\n" "flg eflags .32 .448 0 c1p.a.zstido.n.rv\n" "flg flags .16 .448 0\n" "flg cf .1 .448 0\n" @@ -3374,14 +3390,23 @@ static char *get_reg_profile(RzAnalysis *analysis) { "flg nt .1 .462 0\n" "flg rf .1 .464 0\n" "flg vm .1 .465 0\n" + "flg ac .1 .466 0\n" "drx dr0 .32 0 0\n" "drx dr1 .32 4 0\n" "drx dr2 .32 8 0\n" "drx dr3 .32 12 0\n" - //"drx dr4 .32 16 0\n" - //"drx dr5 .32 20 0\n" + "drx dr4 .32 16 0\n" + "drx dr5 .32 20 0\n" "drx dr6 .32 24 0\n" "drx dr7 .32 28 0\n" + "ctr cr0 .32 0 0\n" + "ctr cr1 .32 4 0\n" + "ctr cr2 .32 8 0\n" + "ctr cr3 .32 12 0\n" + "ctr cr4 .32 16 0\n" + "ctr cr5 .32 20 0\n" + "ctr cr6 .32 24 0\n" + "ctr cr7 .32 28 0\n" "xmm@fpu xmm0 .128 160 4\n" "fpu xmm0l .64 160 0\n" "fpu xmm0h .64 168 0\n" @@ -3530,6 +3555,10 @@ static char *get_reg_profile(RzAnalysis *analysis) { "flg if .1 .1161 0 interrupt\n" "flg df .1 .1162 0 direction\n" "flg of .1 .1163 0 overflow\n" + "flg nt .1 .1166 0\n" + "flg rf .1 .1168 0\n" + "flg vm .1 .1169 0\n" + "flg ac .1 .1170 0\n" "gpr rsp .64 152 0\n" "gpr esp .32 152 0\n" @@ -3546,10 +3575,18 @@ static char *get_reg_profile(RzAnalysis *analysis) { "drx dr1 .64 8 0\n" "drx dr2 .64 16 0\n" "drx dr3 .64 24 0\n" - // dr4 32 - // dr5 40 + "drx dr4 .64 32 0\n" + "drx dr5 .64 40 0\n" "drx dr6 .64 48 0\n" "drx dr7 .64 56 0\n" + "ctr cr0 .64 0 0\n" + "ctr cr1 .64 8 0\n" + "ctr cr2 .64 16 0\n" + "ctr cr3 .64 24 0\n" + "ctr cr4 .64 32 0\n" + "ctr cr5 .64 40 0\n" + "ctr cr6 .64 48 0\n" + "ctr cr7 .64 56 0\n" /*0030 struct user_fpregs_struct 0031 { @@ -3743,6 +3780,7 @@ RzAnalysisPlugin rz_analysis_plugin_x86_cs = { .fini = x86_fini, .esil_init = esil_x86_cs_init, .esil_fini = esil_x86_cs_fini, + .il_config = rz_x86_il_config, // .esil_intr = esil_x86_cs_intr, }; diff --git a/librz/asm/p/asm_x86_nz.c b/librz/asm/p/asm_x86_nz.c index 092fa00b2b..9f1a23961a 100644 --- a/librz/asm/p/asm_x86_nz.c +++ b/librz/asm/p/asm_x86_nz.c @@ -1052,6 +1052,20 @@ static int opaam(RzAsm *a, ut8 *data, const Opcode *op) { return l; } +static int opaad(RzAsm *a, ut8 *data, const Opcode *op) { + is_valid_registers(op); + int l = 0; + int immediate = op->operands[0].immediate * op->operands[0].sign; + data[l++] = 0xd5; + if (immediate == 0) { + data[l++] = 0x0a; + } else if (immediate < 256 && immediate > -129) { + data[l++] = immediate; + } + + return l; +} + static int opdec(RzAsm *a, ut8 *data, const Opcode *op) { if (op->operands[1].type) { RZ_LOG_ERROR("assembler: x86.nz: %s: invalid operands\n", op->mnemonic); @@ -4267,7 +4281,7 @@ typedef struct lookup_t { LookupTable oplookup[] = { { "aaa", 0, NULL, 0x37, 1 }, - { "aad", 0, NULL, 0xd50a, 2 }, + { "aad", 0, opaad, 0 }, { "aam", 0, opaam, 0 }, { "aas", 0, NULL, 0x3f, 1 }, { "adc", 0, &opadc, 0 }, diff --git a/test/db/analysis/x86_16 b/test/db/analysis/x86_16 index 254c5b2eb4..4eb347f444 100644 --- a/test/db/analysis/x86_16 +++ b/test/db/analysis/x86_16 @@ -55,6 +55,461 @@ EXPECT=<>", + "x": { + "opcode": "var", + "value": "_val" + }, + "y": { + "opcode": "bitv", + "bits": "0x1", + "len": 8 + }, + "fill_bit": { + "opcode": "bool", + "value": false + } + } + } + } + } + }, + "y": { + "opcode": "seq", + "x": { + "opcode": "set", + "dst": "pf", + "src": { + "opcode": "is_zero", + "bv": { + "opcode": "mod", + "x": { + "opcode": "var", + "value": "_popcnt" + }, + "y": { + "opcode": "bitv", + "bits": "0x2", + "len": 8 + } + } + } + }, + "y": { + "opcode": "seq", + "x": { + "opcode": "set", + "dst": "zf", + "src": { + "opcode": "is_zero", + "bv": { + "opcode": "var", + "value": "_result" + } + } + }, + "y": { + "opcode": "set", + "dst": "sf", + "src": { + "opcode": "msb", + "bv": { + "opcode": "var", + "value": "_result" + } + } + } + } + } + } + } + } + } + } + }, "sign": false, "prefix": 0, "id": 334, @@ -3121,6 +3328,461 @@ EXPECT=<> (var ax) (bv 8 0x8) false))) (set adjusted (& (+ (var temp_al) (* (var temp_ah) (bv 8 0xa))) (bv 8 0xff))) (set ax (| (& (var ax) (~ (bv 16 0xff))) (cast 16 false (var adjusted)))) (set ax (| (& (var ax) (~ (bv 16 0xff00))) (<< (cast 16 false (bv 8 0x0)) (bv 8 0x8) false))) (set _result (var adjusted)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +ad "aad 0x42" d542 0x0 (seq (set temp_al (cast 8 false (var ax))) (set temp_ah (cast 8 false (>> (var ax) (bv 8 0x8) false))) (set adjusted (& (+ (var temp_al) (* (var temp_ah) (bv 8 0x42))) (bv 8 0xff))) (set ax (| (& (var ax) (~ (bv 16 0xff))) (cast 16 false (var adjusted)))) (set ax (| (& (var ax) (~ (bv 16 0xff00))) (<< (cast 16 false (bv 8 0x0)) (bv 8 0x8) false))) (set _result (var adjusted)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +ad "aam" d40a 0x0 (seq (set temp_al (cast 8 false (var ax))) (set ax (| (& (var ax) (~ (bv 16 0xff00))) (<< (cast 16 false (div (var temp_al) (bv 8 0xa))) (bv 8 0x8) false))) (set adjusted (mod (var temp_al) (bv 8 0xa))) (set ax (| (& (var ax) (~ (bv 16 0xff))) (cast 16 false (var adjusted)))) (set _result (var adjusted)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +ad "aam 0x42" d442 0x0 (seq (set temp_al (cast 8 false (var ax))) (set ax (| (& (var ax) (~ (bv 16 0xff00))) (<< (cast 16 false (div (var temp_al) (bv 8 0x42))) (bv 8 0x8) false))) (set adjusted (mod (var temp_al) (bv 8 0x42))) (set ax (| (& (var ax) (~ (bv 16 0xff))) (cast 16 false (var adjusted)))) (set _result (var adjusted)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +ad "aas" 3f 0x0 (seq (branch (|| (! (ule (& (cast 8 false (var ax)) (bv 8 0xf)) (bv 8 0x9))) (var af)) (seq (set ax (- (var ax) (bv 16 0x6))) (set ax (| (& (var ax) (~ (bv 16 0xff00))) (<< (cast 16 false (- (cast 8 false (>> (var ax) (bv 8 0x8) false)) (bv 8 0x1))) (bv 8 0x8) false))) (set af true) (set cf true)) (seq (set af false) (set cf false))) (set ax (| (& (var ax) (~ (bv 16 0xff))) (cast 16 false (& (cast 8 false (var ax)) (bv 8 0xf)))))) +adB "cbw" 98 +d "call 0" e8fdff 0x0 (seq (set _cs (cast 16 false (var cs))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var _cs))) (set _pc (bv 16 0x0)) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var _pc)))) +d "enter 8, 0" c8080000 0x0 (seq (set _alloc_sz (cast 16 false (bv 16 0x8))) (set _nest_lvl (mod (cast 8 false (bv 16 0x0)) (bv 8 0x20))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var bp))) (set _frame_tmp (var sp)) (branch (is_zero (var _nest_lvl)) nop (seq (branch (! (ule (var _nest_lvl) (bv 8 0x1))) (seq (set _itr (bv 8 0x1)) (repeat (&& (ule (var _itr) (var _nest_lvl)) (! (== (var _itr) (var _nest_lvl)))) (seq (set bp (- (var bp) (bv 16 0x2))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (loadw 0 16 (var bp)))) (set _itr (+ (var _itr) (bv 8 0x1)))))) nop) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var _frame_tmp))))) (set sp (- (var sp) (cast 16 false (var _alloc_sz)))) (set bp (cast 16 false (cast 15 false (var _frame_tmp))))) +a "jmp 0x0" ebfe 0x0 (jmp (+ (bv 16 0x0) (bv 16 0x0))) +a "jmp 0x10" eb0e 0x0 (jmp (+ (bv 16 0x0) (bv 16 0x10))) +a "jmp 0x34" eb32 0x0 (jmp (+ (bv 16 0x0) (bv 16 0x34))) +a "jne 0x14" 7512 0x0 (branch (! (var zf)) (jmp (+ (bv 16 0x0) (bv 16 0x14))) nop) +a "jnz 0x94" 660f858d000000 0x0 (branch (! (var zf)) (jmp (+ (bv 16 0x0) (bv 16 0x94))) nop) +a "jnz -0x94" 660f8565ffffff 0x0 (branch (! (var zf)) (jmp (+ (bv 16 0x0) (bv 16 0xff6c))) nop) +a "jno -0x34" 71ca 0x0 (branch (! (var of)) (jmp (+ (bv 16 0x0) (bv 16 0xffcc))) nop) dB "jmp 0xfec50" e95bec -d "jmp 0x1fec50" e95bec 0x001ffff2 -a "mov al, [0xbeef]" a0efbe -a "mov ax, [0xbeef]" a1efbe -a "test bl, 0x12" f6c312 -a "test bx, 0x1234" f7c33412 +d "jmp 0x1fec50" e95bec 0x1ffff2 (jmp (+ (bv 16 0xfff2) (bv 16 0xec50))) +ad "leave" c9 0x0 (seq (set sp (var bp)) (set sp (+ (var sp) (bv 16 0x2))) (set bp (loadw 0 16 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false))))) +ad "loop 0xff92" e290 0x0 (seq (set cx (- (var cx) (bv 16 0x1))) (branch (! (is_zero (var cx))) (jmp (bv 16 0xff92)) nop)) +a "mov al, [0xbeef]" a0efbe 0x0 (set ax (| (& (var ax) (~ (bv 16 0xff))) (cast 16 false (loadw 0 8 (bv 16 0xbeef))))) +a "mov ax, [0xbeef]" a1efbe 0x0 (set ax (loadw 0 16 (bv 16 0xbeef))) +d "popf" 9d 0x0 (seq (set _flags (loadw 0 16 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)))) (set cf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set pf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set af (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set zf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set sf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set tf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set if (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set df (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set of (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x3) false)) (set nt (lsb (var _flags))) (set sp (+ (var sp) (bv 16 0x2)))) +ad "push ax" 50 0x0 (seq (set sp (- (var sp) (bv 16 0x4))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var ax)))) +d "pushf" 9c 0x0 (seq (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (ite false (bv 16 0x1) (bv 16 0x0)) (bv 16 0x1) false) (ite (var nt) (bv 16 0x1) (bv 16 0x0))) (bv 16 0x2) false) (bv 16 0x3)) (bv 16 0x1) false) (ite (var of) (bv 16 0x1) (bv 16 0x0))) (bv 16 0x1) false) (ite (var df) (bv 16 0x1) (bv 16 0x0))) (bv 16 0x1) false) (ite (var if) (bv 16 0x1) (bv 16 0x0))) (bv 16 0x1) false) (ite (var tf) (bv 16 0x1) (bv 16 0x0))) (bv 16 0x1) false) (ite (var zf) (bv 16 0x1) (bv 16 0x0))) (bv 16 0x1) false) (ite (var zf) (bv 16 0x1) (bv 16 0x0))) (bv 16 0x2) false) (ite (var af) (bv 16 0x1) (bv 16 0x0))) (bv 16 0x2) false) (ite (var pf) (bv 16 0x1) (bv 16 0x0))) (bv 16 0x1) false) (bv 16 0x1)) (bv 16 0x1) false) (ite (var cf) (bv 16 0x1) (bv 16 0x0)))))) +d "pushaw" 60 0x0 (seq (set _sp (var sp)) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var ax))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var cx))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var dx))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var bx))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var _sp))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var bp))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var si))) (set sp (- (var sp) (bv 16 0x2))) (storew 0 (+ (+ (cast 16 false (var sp)) (bv 16 0x0)) (<< (cast 16 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var di)))) +a "test bl, 0x12" f6c312 0x0 (seq (set _res (& (cast 8 false (var bx)) (bv 8 0x12))) (set bx (| (& (var bx) (~ (bv 16 0xff))) (cast 16 false (var _res)))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +a "test bx, 0x1234" f7c33412 0x0 (seq (set _res (& (var bx) (bv 16 0x1234))) (set bx (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) aB "test byte [bx], 0x12" f60712 aB "test word [bx], 0x1234" f7073412 +a "xlatb" d7 0x0 (set ax (| (& (var ax) (~ (bv 16 0xff))) (cast 16 false (loadw 0 8 (+ (+ (+ (var bx) (bv 16 0x0)) (<< (cast 16 false (var ds)) (bv 8 0x4) false)) (cast 16 false (cast 8 false (var ax)))))))) diff --git a/test/db/asm/x86_32 b/test/db/asm/x86_32 index 9c2ea84dc7..0d3fa314e5 100644 --- a/test/db/asm/x86_32 +++ b/test/db/asm/x86_32 @@ -1,35 +1,37 @@ -ad "lea edx, [0x2c4b]" 8d154b2c0000 -d "aaa" 37 -d "aad" d50a -d "aam" d40a -d "aas" 3F -d "adc al, 0" 1400 -d "adc al, byte [eax]" 1200 -d "adc byte [eax], al" 1000 -d "adc dword [eax], eax" 1100 -d "adc eax, dword [eax]" 1300 -d "add al, 0" 0400 -d "add al, byte [eax]" 0200 -d "add byte [bx + si], al" 670000 -d "add byte [eax], 0" 800000 -d "add byte [eax], 0" 820000 -d "add byte [eax], al" 0000 -d "add byte [eax], al" 0000 -d "add dword [eax], 0" 810000000000 -d "add dword [eax], 0" 830000 -d "add dword [eax], eax" 0100 -d "add eax, dword [eax]" 0300 +d "lea edx, [0x2c4b]" 8d154b2c0000 0x0 (set edx (bv 32 0x2c4b)) +d "aaa" 37 0x0 (seq (branch (|| (! (ule (& (cast 8 false (var eax)) (bv 8 0xf)) (bv 8 0x9))) (var af)) (seq (set eax (| (& (var eax) (~ (bv 32 0xffff))) (cast 32 false (+ (cast 16 false (var eax)) (bv 16 0x106))))) (set af true) (set cf true)) (seq (set af false) (set cf false))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (& (cast 8 false (var eax)) (bv 8 0xf)))))) +d "aad" d50a 0x0 (seq (set temp_al (cast 8 false (var eax))) (set temp_ah (cast 8 false (>> (var eax) (bv 8 0x8) false))) (set adjusted (& (+ (var temp_al) (* (var temp_ah) (bv 8 0xa))) (bv 8 0xff))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var adjusted)))) (set eax (| (& (var eax) (~ (bv 32 0xff00))) (<< (cast 32 false (bv 8 0x0)) (bv 8 0x8) false))) (set _result (var adjusted)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "aad 0x69" d569 0x0 (seq (set temp_al (cast 8 false (var eax))) (set temp_ah (cast 8 false (>> (var eax) (bv 8 0x8) false))) (set adjusted (& (+ (var temp_al) (* (var temp_ah) (bv 8 0x69))) (bv 8 0xff))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var adjusted)))) (set eax (| (& (var eax) (~ (bv 32 0xff00))) (<< (cast 32 false (bv 8 0x0)) (bv 8 0x8) false))) (set _result (var adjusted)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "aam" d40a 0x0 (seq (set temp_al (cast 8 false (var eax))) (set eax (| (& (var eax) (~ (bv 32 0xff00))) (<< (cast 32 false (div (var temp_al) (bv 8 0xa))) (bv 8 0x8) false))) (set adjusted (mod (var temp_al) (bv 8 0xa))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var adjusted)))) (set _result (var adjusted)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "aam 0x42" d442 0x0 (seq (set temp_al (cast 8 false (var eax))) (set eax (| (& (var eax) (~ (bv 32 0xff00))) (<< (cast 32 false (div (var temp_al) (bv 8 0x42))) (bv 8 0x8) false))) (set adjusted (mod (var temp_al) (bv 8 0x42))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var adjusted)))) (set _result (var adjusted)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "aas" 3f 0x0 (seq (branch (|| (! (ule (& (cast 8 false (var eax)) (bv 8 0xf)) (bv 8 0x9))) (var af)) (seq (set eax (| (& (var eax) (~ (bv 32 0xffff))) (cast 32 false (- (cast 16 false (var eax)) (bv 16 0x6))))) (set eax (| (& (var eax) (~ (bv 32 0xff00))) (<< (cast 32 false (- (cast 8 false (>> (var eax) (bv 8 0x8) false)) (bv 8 0x1))) (bv 8 0x8) false))) (set af true) (set cf true)) (seq (set af false) (set cf false))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (& (cast 8 false (var eax)) (bv 8 0xf)))))) +d "adc al, 0" 1400 0x0 (seq (set op1 (cast 8 false (var eax))) (set op2 (bv 8 0x0)) (set sum (+ (+ (var op1) (var op2)) (ite (var cf) (bv 8 0x1) (bv 8 0x0)))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var sum)))) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) +d "adc al, byte [eax]" 1200 0x0 (seq (set op1 (cast 8 false (var eax))) (set op2 (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set sum (+ (+ (var op1) (var op2)) (ite (var cf) (bv 8 0x1) (bv 8 0x0)))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var sum)))) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) +d "adc byte [eax], al" 1000 0x0 (seq (set op1 (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set op2 (cast 8 false (var eax))) (set sum (+ (+ (var op1) (var op2)) (ite (var cf) (bv 8 0x1) (bv 8 0x0)))) (storew 0 (+ (var eax) (bv 32 0x0)) (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) +d "adc dword [eax], eax" 1100 0x0 (seq (set op1 (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set op2 (var eax)) (set sum (+ (+ (var op1) (var op2)) (ite (var cf) (bv 32 0x1) (bv 32 0x0)))) (storew 0 (+ (var eax) (bv 32 0x0)) (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) +d "adc eax, dword [eax]" 1300 0x0 (seq (set op1 (var eax)) (set op2 (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set sum (+ (+ (var op1) (var op2)) (ite (var cf) (bv 32 0x1) (bv 32 0x0)))) (set eax (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) +d "add al, 0" 0400 0x0 (seq (set op1 (cast 8 false (var eax))) (set op2 (bv 8 0x0)) (set sum (+ (var op1) (var op2))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var sum)))) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) +d "add al, byte [eax]" 0200 0x0 (seq (set op1 (cast 8 false (var eax))) (set op2 (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set sum (+ (var op1) (var op2))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var sum)))) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) +d "add byte [bx + si], al" 670000 0x0 (seq (set op1 (loadw 0 8 (+ (+ (cast 32 false (cast 16 false (var ebx))) (* (cast 32 false (cast 16 false (var esi))) (bv 32 0x1))) (bv 32 0x0)))) (set op2 (cast 8 false (var eax))) (set sum (+ (var op1) (var op2))) (storew 0 (+ (+ (cast 32 false (cast 16 false (var ebx))) (* (cast 32 false (cast 16 false (var esi))) (bv 32 0x1))) (bv 32 0x0)) (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) +d "add byte [eax], 0" 800000 0x0 (seq (set op1 (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set op2 (bv 8 0x0)) (set sum (+ (var op1) (var op2))) (storew 0 (+ (var eax) (bv 32 0x0)) (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) +d "add byte [eax], 0" 820000 0x0 (seq (set op1 (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set op2 (bv 8 0x0)) (set sum (+ (var op1) (var op2))) (storew 0 (+ (var eax) (bv 32 0x0)) (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) +d "add byte [eax], al" 0000 0x0 (seq (set op1 (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set op2 (cast 8 false (var eax))) (set sum (+ (var op1) (var op2))) (storew 0 (+ (var eax) (bv 32 0x0)) (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) +d "add byte [eax], al" 0000 0x0 (seq (set op1 (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set op2 (cast 8 false (var eax))) (set sum (+ (var op1) (var op2))) (storew 0 (+ (var eax) (bv 32 0x0)) (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) +d "add dword [eax], 0" 810000000000 0x0 (seq (set op1 (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set op2 (bv 32 0x0)) (set sum (+ (var op1) (var op2))) (storew 0 (+ (var eax) (bv 32 0x0)) (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) +d "add dword [eax], 0" 830000 0x0 (seq (set op1 (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set op2 (bv 32 0x0)) (set sum (+ (var op1) (var op2))) (storew 0 (+ (var eax) (bv 32 0x0)) (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) +d "add dword [eax], eax" 0100 0x0 (seq (set op1 (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set op2 (var eax)) (set sum (+ (var op1) (var op2))) (storew 0 (+ (var eax) (bv 32 0x0)) (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) +d "add eax, dword [eax]" 0300 0x0 (seq (set op1 (var eax)) (set op2 (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set sum (+ (var op1) (var op2))) (set eax (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) d "addsd xmm0, qword [eax]" f20f5800 d "addss xmm0, dword [eax]" f30f5800 d "addsubpd xmm0, xmmword [eax]" 660fd000 d "addsubps xmm0, xmmword [eax]" f20fd000 -d "and al, 0" 2400 -d "and al, byte [eax]" 2200 -d "and byte [eax], al" 2000 -d "and dword [eax], eax" 2100 -d "and eax, dword [eax]" 2300 +d "and al, 0" 2400 0x0 (seq (set and_ (& (cast 8 false (var eax)) (bv 8 0x0))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var and_)))) (set of false) (set cf false) (set _result (var and_)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "and al, byte [eax]" 2200 0x0 (seq (set and_ (& (cast 8 false (var eax)) (loadw 0 8 (+ (var eax) (bv 32 0x0))))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var and_)))) (set of false) (set cf false) (set _result (var and_)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "and byte [eax], al" 2000 0x0 (seq (set and_ (& (loadw 0 8 (+ (var eax) (bv 32 0x0))) (cast 8 false (var eax)))) (storew 0 (+ (var eax) (bv 32 0x0)) (var and_)) (set of false) (set cf false) (set _result (var and_)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "and dword [eax], eax" 2100 0x0 (seq (set and_ (& (loadw 0 32 (+ (var eax) (bv 32 0x0))) (var eax))) (storew 0 (+ (var eax) (bv 32 0x0)) (var and_)) (set of false) (set cf false) (set _result (var and_)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "and eax, dword [eax]" 2300 0x0 (seq (set and_ (& (var eax) (loadw 0 32 (+ (var eax) (bv 32 0x0))))) (set eax (var and_)) (set of false) (set cf false) (set _result (var and_)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) d "arpl word [eax], ax" 6300 -d "bound eax, qword [eax]" 6200 +d "bound eax, qword [eax]" 6200 0x0 (seq (set _index (var eax)) (set _lower (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set _upper (loadw 0 32 (+ (var eax) (bv 32 0x8)))) (branch (|| (&& (ule (var _index) (var _lower)) (! (== (var _index) (var _lower)))) (! (ule (var _index) (var _upper)))) (seq (goto int) empty) nop)) d "bsf eax, dword [eax]" 0fbc00 d "bsr eax, dword [eax]" 0fbd00 d "bswap eax" 0fc8 @@ -47,15 +49,15 @@ d "bts dword [eax], eax" 0fab00 d "call 4" 66e80000 d "call 5" e800000000 d "call dword [eax]" ff10 -d "cbw" 6698 +d "cbw" 6698 0x0 (set eax (| (& (var eax) (~ (bv 32 0xffff))) (cast 32 false (cast 16 false (cast 8 false (var eax)))))) d "cdq" 99 -d "clc" F8 -d "cld" FC +d "clc" f8 0x0 (set cf false) +d "cld" fc 0x0 (set df false) d "clflush byte [eax]" 0fae38 d "clgi" 0f01dd -d "cli" FA +d "cli" fa 0x0 (set if false) d "clts" 0f06 -d "cmc" F5 +d "cmc" f5 0x0 (set cf (! (var cf))) d "cmova eax, dword [eax]" 0f4700 d "cmovae eax, dword [eax]" 0f4300 d "cmovb eax, dword [eax]" 0f4200 @@ -72,11 +74,11 @@ d "cmovns eax, dword [eax]" 0f4900 d "cmovo eax, dword [eax]" 0f4000 d "cmovp eax, dword [eax]" 0f4a00 d "cmovs eax, dword [eax]" 0f4800 -d "cmp al, 0" 3c00 -d "cmp al, byte [eax]" 3a00 -d "cmp byte [eax], al" 3800 -d "cmp dword [eax], eax" 3900 -d "cmp eax, dword [eax]" 3b00 +d "cmp al, 0" 3c00 0x0 (seq (set op1 (cast 8 false (var eax))) (set op2 (bv 8 0x0)) (set sub (- (var op1) (var op2))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "cmp al, byte [eax]" 3a00 0x0 (seq (set op1 (cast 8 false (var eax))) (set op2 (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set sub (- (var op1) (var op2))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "cmp byte [eax], al" 3800 0x0 (seq (set op1 (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set op2 (cast 8 false (var eax))) (set sub (- (var op1) (var op2))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "cmp dword [eax], eax" 3900 0x0 (seq (set op1 (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set op2 (var eax)) (set sub (- (var op1) (var op2))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "cmp eax, dword [eax]" 3b00 0x0 (seq (set op1 (var eax)) (set op2 (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set sub (- (var op1) (var op2))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) d "cmpeqpd xmm0, xmmword [eax]" 660fc20000 d "cmpeqps xmm0, xmmword [eax]" 0fc20000 d "cmpeqsd xmm0, qword [eax]" f20fc20000 @@ -105,8 +107,6 @@ d "cmpordpd xmm0, xmmword [eax]" 660fc20007 d "cmpordps xmm0, xmmword [eax]" 0fc20007 d "cmpordsd xmm0, qword [eax]" f20fc20007 d "cmpordss xmm0, dword [eax]" f30fc20007 -d "cmpsb byte [esi], byte ptr es:[edi]" a6 -d "cmpsd dword [esi], dword ptr es:[edi]" a7 d "cmpunordpd xmm0, xmmword [eax]" 660fc20003 d "cmpunordps xmm0, xmmword [eax]" 0fc20003 d "cmpunordsd xmm0, qword [eax]" f20fc20003 @@ -118,106 +118,116 @@ d "crc32 eax, byte [eax]" f20f38f000 d "crc32 eax, dword [eax]" f20f38f100 d "cwd" 6699 d "cwde" 98 -d "daa" 27 -d "das" 2F -d "dec byte [eax]" fe08 -d "dec dword [eax]" ff08 -d "dec eax" 48 -d "dec ebp" 4d -d "dec ebx" 4b -d "dec ecx" 49 -d "dec edi" 4f -d "dec edx" 4a -d "dec esi" 4e -d "dec esp" 4c -d "div byte [eax]" f630 +d "daa" 27 0x0 (seq (set old_al (cast 8 false (var eax))) (set old_cf (var cf)) (set cf false) (branch (|| (! (ule (& (cast 8 false (var eax)) (bv 8 0xf)) (bv 8 0x9))) (var af)) (seq (set _al (cast 8 false (var eax))) (set _sum (+ (var _al) (bv 8 0x6))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _sum)))) (set cf (|| (var old_cf) (|| (|| (&& (! (msb (var _al))) (msb (bv 8 0x6))) (&& (msb (bv 8 0x6)) (msb (var _sum)))) (&& (msb (var _sum)) (! (msb (var _al))))))) (set af true)) (set af false)) (branch (|| (! (ule (var old_al) (bv 8 0x99))) (var old_cf)) (seq (set _al (cast 8 false (var eax))) (set _sum (+ (var _al) (bv 8 0x60))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _sum)))) (set cf true)) (set cf false)) (set _result (cast 8 false (var eax))) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "das" 2f 0x0 (seq (set old_al (cast 8 false (var eax))) (set old_cf (var cf)) (set cf false) (branch (|| (! (ule (& (cast 8 false (var eax)) (bv 8 0xf)) (bv 8 0x9))) (var af)) (seq (set _al (cast 8 false (var eax))) (set _sum (- (var _al) (bv 8 0x6))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _sum)))) (set cf (|| (var old_cf) (|| (|| (&& (! (msb (var _al))) (msb (bv 8 0x6))) (&& (msb (bv 8 0x6)) (msb (var _sum)))) (&& (msb (var _sum)) (! (msb (var _al))))))) (set af true)) (set af false)) (branch (|| (! (ule (var old_al) (bv 8 0x99))) (var old_cf)) (seq (set _al (cast 8 false (var eax))) (set _sum (- (var _al) (bv 8 0x60))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _sum)))) (set cf true)) nop) (set _result (cast 8 false (var eax))) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "dec byte [eax]" fe08 0x0 (seq (set _op (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set _dec (- (var _op) (bv 8 0x1))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +d "dec dword [eax]" ff08 0x0 (seq (set _op (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +d "dec eax" 48 0x0 (seq (set _op (var eax)) (set _dec (- (var _op) (bv 32 0x1))) (set eax (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +d "dec ebp" 4d 0x0 (seq (set _op (var ebp)) (set _dec (- (var _op) (bv 32 0x1))) (set ebp (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +d "dec ebx" 4b 0x0 (seq (set _op (var ebx)) (set _dec (- (var _op) (bv 32 0x1))) (set ebx (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +d "dec ecx" 49 0x0 (seq (set _op (var ecx)) (set _dec (- (var _op) (bv 32 0x1))) (set ecx (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +d "dec edi" 4f 0x0 (seq (set _op (var edi)) (set _dec (- (var _op) (bv 32 0x1))) (set edi (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +d "dec edx" 4a 0x0 (seq (set _op (var edx)) (set _dec (- (var _op) (bv 32 0x1))) (set edx (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +d "dec esi" 4e 0x0 (seq (set _op (var esi)) (set _dec (- (var _op) (bv 32 0x1))) (set esi (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +d "dec esp" 4c 0x0 (seq (set _op (var esp)) (set _dec (- (var _op) (bv 32 0x1))) (set esp (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +d "div byte [eax]" f630 0x0 (seq (set _src (cast 16 false (loadw 0 8 (+ (var eax) (bv 32 0x0))))) (branch (is_zero (var _src)) nop (seq (set _ax (cast 16 false (var eax))) (set _temp (cast 8 false (div (var _ax) (var _src)))) (branch (! (ule (var _temp) (bv 8 0xff))) nop (seq (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _temp)))) (set eax (| (& (var eax) (~ (bv 32 0xff00))) (<< (cast 32 false (mod (var _ax) (var _src))) (bv 8 0x8) false)))))))) +ad "div ax" 66f7f0 0x0 (seq (set _src (cast 32 false (cast 16 false (var eax)))) (branch (is_zero (var _src)) nop (seq (set _dxax (| (<< (cast 32 false (cast 16 false (var edx))) (bv 8 0x10) false) (cast 32 false (cast 16 false (var eax))))) (set _temp (cast 16 false (div (var _dxax) (var _src)))) (branch (! (ule (var _temp) (bv 16 0xffff))) nop (seq (set eax (| (& (var eax) (~ (bv 32 0xffff))) (cast 32 false (var _temp)))) (set edx (| (& (var edx) (~ (bv 32 0xffff))) (cast 32 false (mod (var _dxax) (var _src)))))))))) +ad "div eax" f7f0 0x0 (seq (set _src (cast 64 false (var eax))) (branch (is_zero (var _src)) nop (seq (set _edxeax (| (<< (cast 64 false (var edx)) (bv 8 0x20) false) (cast 64 false (var eax)))) (set _temp (cast 32 false (div (var _edxeax) (var _src)))) (branch (! (ule (var _temp) (bv 32 0xffffffff))) nop (seq (set eax (| (& (var eax) (~ (bv 32 0xffff))) (cast 32 false (var _temp)))) (set edx (| (& (var edx) (~ (bv 32 0xffff))) (cast 32 false (mod (var _edxeax) (var _src)))))))))) d "divsd xmm0, qword [eax]" f20f5e00 d "divss xmm0, dword [eax]" f30f5e00 d "emms" 0f77 ad "endbr32" f30f1efb +d "enter 2, 0" c8020000 0x0 (seq (set _alloc_sz (cast 16 false (bv 32 0x2))) (set _nest_lvl (mod (cast 8 false (bv 32 0x0)) (bv 8 0x20))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var ebp))) (set _frame_tmp (var esp)) (branch (is_zero (var _nest_lvl)) nop (seq (branch (! (ule (var _nest_lvl) (bv 8 0x1))) (seq (set _itr (bv 8 0x1)) (repeat (&& (ule (var _itr) (var _nest_lvl)) (! (== (var _itr) (var _nest_lvl)))) (seq (set ebp (- (var ebp) (bv 32 0x4))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (loadw 0 32 (var ebp)))) (set _itr (+ (var _itr) (bv 8 0x1)))))) nop) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _frame_tmp))))) (set esp (- (var esp) (cast 32 false (var _alloc_sz)))) (set ebp (var _frame_tmp))) +d "enter 8, 0" 66c8080000 0x0 (seq (set _alloc_sz (cast 16 false (bv 16 0x8))) (set _nest_lvl (mod (cast 8 false (bv 16 0x0)) (bv 8 0x20))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 16 false (cast 16 false (var ebp)))) (set _frame_tmp (var esp)) (branch (is_zero (var _nest_lvl)) nop (seq (branch (! (ule (var _nest_lvl) (bv 8 0x1))) (seq (set _itr (bv 8 0x1)) (repeat (&& (ule (var _itr) (var _nest_lvl)) (! (== (var _itr) (var _nest_lvl)))) (seq (set ebp (- (var ebp) (bv 32 0x2))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 16 false (loadw 0 16 (var ebp)))) (set _itr (+ (var _itr) (bv 8 0x1)))))) nop) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 16 false (var _frame_tmp))))) (set esp (- (var esp) (cast 32 false (var _alloc_sz)))) (set ebp (| (& (var ebp) (~ (bv 32 0xffff))) (cast 32 false (cast 16 false (cast 15 false (var _frame_tmp))))))) d "femms" 0f0e d "fxrstor [eax]" 0fae08 d "fxsave [eax]" 0fae00 d "getsec" 0f37 d "haddpd xmm0, xmmword [eax]" 660f7c00 d "haddps xmm0, xmmword [eax]" f20f7c00 -d "hlt" F4 +d "hlt" f4 0x0 (seq (goto halt) empty) d "hsubpd xmm0, xmmword [eax]" 660f7d00 d "hsubps xmm0, xmmword [eax]" f20f7d00 -d "idiv byte [eax]" f638 -d "imul byte [eax]" f628 -d "imul eax, dword [eax]" 0faf00 -d "imul eax, dword [eax], 0" 690000000000 -d "imul eax, dword [eax], 0" 6b0000 -d "in al, 0" E400 -d "in al, dx" ec -d "in eax, 0" E500 -d "in eax, 0x8c" e58c -d "in eax, dx" ed -d "inc byte [eax]" fe00 -d "inc dword [eax]" ff00 -d "inc eax" 40 -d "inc ebp" 45 -d "inc ebx" 43 -d "inc ecx" 41 -d "inc edi" 47 -d "inc edx" 42 -d "inc esi" 46 -d "inc esp" 44 +d "idiv byte [eax]" f638 0x0 (seq (set _src (cast 16 false (loadw 0 8 (+ (var eax) (bv 32 0x0))))) (branch (is_zero (var _src)) nop (seq (set _ax (cast 16 false (var eax))) (set _temp (cast 8 false (sdiv (var _ax) (var _src)))) (branch (|| (! (sle (var _temp) (bv 8 0x7f))) (&& (sle (var _temp) (bv 8 0x80)) (! (== (var _temp) (bv 8 0x80))))) nop (seq (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _temp)))) (set eax (| (& (var eax) (~ (bv 32 0xff00))) (<< (cast 32 false (smod (var _ax) (var _src))) (bv 8 0x8) false)))))))) +d "idiv ax" 66f7f8 0x0 (seq (set _src (cast 32 false (cast 16 false (var eax)))) (branch (is_zero (var _src)) nop (seq (set _dxax (| (<< (cast 32 false (cast 16 false (var edx))) (bv 8 0x10) false) (cast 32 false (cast 16 false (var eax))))) (set _temp (cast 16 false (sdiv (var _dxax) (var _src)))) (branch (|| (! (sle (var _temp) (bv 16 0x7fff))) (&& (sle (var _temp) (bv 16 0x8000)) (! (== (var _temp) (bv 16 0x8000))))) nop (seq (set eax (| (& (var eax) (~ (bv 32 0xffff))) (cast 32 false (var _temp)))) (set edx (| (& (var edx) (~ (bv 32 0xffff))) (cast 32 false (smod (var _dxax) (var _src)))))))))) +d "idiv eax" f7f8 0x0 (seq (set _src (cast 64 false (var eax))) (branch (is_zero (var _src)) nop (seq (set _edxeax (| (<< (cast 64 false (var edx)) (bv 8 0x20) false) (cast 64 false (var eax)))) (set _temp (cast 32 false (sdiv (var _edxeax) (var _src)))) (branch (|| (! (sle (var _temp) (bv 32 0x7fffffff))) (&& (sle (var _temp) (bv 32 0x80000000)) (! (== (var _temp) (bv 32 0x80000000))))) nop (seq (set eax (| (& (var eax) (~ (bv 32 0xffff))) (cast 32 false (var _temp)))) (set edx (| (& (var edx) (~ (bv 32 0xffff))) (cast 32 false (smod (var _edxeax) (var _src)))))))))) +d "imul byte [eax]" f628 0x0 (seq (set _tmp_xp (* (cast 16 (msb (cast 8 false (var eax))) (cast 8 false (var eax))) (cast 16 (msb (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (loadw 0 8 (+ (var eax) (bv 32 0x0)))))) (set eax (| (& (var eax) (~ (bv 32 0xffff))) (cast 32 false (var _tmp_xp)))) (branch (== (cast 16 (msb (cast 8 false (var _tmp_xp))) (cast 8 false (var _tmp_xp))) (var _tmp_xp)) (seq (set cf false) (set of false)) (seq (set cf true) (set of true)))) +d "imul eax, dword [eax]" 0faf00 0x0 (seq (set _dest (var eax)) (set _tmp_xp (* (cast 64 (msb (var _dest)) (var _dest)) (cast 64 (msb (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (loadw 0 32 (+ (var eax) (bv 32 0x0)))))) (set _dest (cast 32 false (var _tmp_xp))) (set eax (var _dest)) (branch (== (cast 64 (msb (var _dest)) (var _dest)) (var _tmp_xp)) (seq (set cf false) (set of false)) (seq (set cf true) (set of true)))) +d "imul eax, dword [eax], 0" 690000000000 0x0 (seq (set _tmp_xp (* (cast 64 (msb (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (cast 64 (msb (bv 32 0x0)) (bv 32 0x0)))) (set _dest (cast 32 false (var _tmp_xp))) (set eax (var _dest)) (branch (== (cast 64 (msb (var _dest)) (var _dest)) (var _tmp_xp)) (seq (set cf false) (set of false)) (seq (set cf true) (set of true)))) +d "imul eax, dword [eax], 0" 6b0000 0x0 (seq (set _tmp_xp (* (cast 64 (msb (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (cast 64 (msb (bv 32 0x0)) (bv 32 0x0)))) (set _dest (cast 32 false (var _tmp_xp))) (set eax (var _dest)) (branch (== (cast 64 (msb (var _dest)) (var _dest)) (var _tmp_xp)) (seq (set cf false) (set of false)) (seq (set cf true) (set of true)))) +ad "imul ax" 66f7e8 0x0 (seq (set _tmp_xp (* (cast 32 (msb (cast 16 false (var eax))) (cast 16 false (var eax))) (cast 32 (msb (cast 16 false (var eax))) (cast 16 false (var eax))))) (set eax (| (& (var eax) (~ (bv 32 0xffff))) (cast 32 false (cast 16 false (var _tmp_xp))))) (set edx (| (& (var edx) (~ (bv 32 0xffff))) (cast 32 false (cast 32 false (>> (var _tmp_xp) (bv 8 0x10) false))))) (branch (== (cast 32 (msb (cast 16 false (var _tmp_xp))) (cast 16 false (var _tmp_xp))) (var _tmp_xp)) (seq (set cf false) (set of false)) (seq (set cf true) (set of true)))) +d "in al, 0" e400 0x0 (seq (goto port) empty) +d "in al, dx" ec 0x0 (seq (goto port) empty) +d "in eax, 0" e500 0x0 (seq (goto port) empty) +d "in eax, 0x8c" e58c 0x0 (seq (goto port) empty) +d "in eax, dx" ed 0x0 (seq (goto port) empty) +d "inc byte [eax]" fe00 0x0 (seq (set _op (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set _result (+ (var _op) (bv 8 0x1))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "inc dword [eax]" ff00 0x0 (seq (set _op (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "inc eax" 40 0x0 (seq (set _op (var eax)) (set _result (+ (var _op) (bv 32 0x1))) (set eax (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "inc ebp" 45 0x0 (seq (set _op (var ebp)) (set _result (+ (var _op) (bv 32 0x1))) (set ebp (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "inc ebx" 43 0x0 (seq (set _op (var ebx)) (set _result (+ (var _op) (bv 32 0x1))) (set ebx (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "inc ecx" 41 0x0 (seq (set _op (var ecx)) (set _result (+ (var _op) (bv 32 0x1))) (set ecx (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "inc edi" 47 0x0 (seq (set _op (var edi)) (set _result (+ (var _op) (bv 32 0x1))) (set edi (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "inc edx" 42 0x0 (seq (set _op (var edx)) (set _result (+ (var _op) (bv 32 0x1))) (set edx (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "inc esi" 46 0x0 (seq (set _op (var esi)) (set _result (+ (var _op) (bv 32 0x1))) (set esi (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "inc esp" 44 0x0 (seq (set _op (var esp)) (set _result (+ (var _op) (bv 32 0x1))) (set esp (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) d "insb byte es:[edi], dx" 6c d "insd dword es:[edi], dx" 6d -d "int 1" CD01 -d "int 3" CD03 +d "int 1" cd01 0x0 (seq (goto int) empty) +d "int 3" cd03 0x0 (seq (goto int) empty) d "int1" F1 d "int3" CC -d "into" CE +d "into" ce 0x0 (branch (var of) (seq (goto int) empty) nop) d "invd" 0f08 d "invlpg byte [eax]" 0f0138 -d "iret" 66CF +d "iret" 66cf 0x0 empty d "iretd" CF -d "ja 2" 7700 -d "ja 6" 0f8700000000 -d "jae 2" 7300 -d "jae 6" 0f8300000000 -d "jb 2" 7200 -d "jb 6" 0f8200000000 -d "jbe 2" 7600 -d "jbe 6" 0f8600000000 -d "je 2" 7400 -d "je 6" 0f8400000000 -d "jg 2" 7f00 -d "jg 6" 0f8f00000000 -d "jge 2" 7d00 -d "jge 6" 0f8d00000000 -d "jl 2" 7c00 -d "jl 6" 0f8c00000000 -d "jle 2" 7e00 -d "jle 6" 0f8e00000000 +d "ja 2" 7700 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +d "ja 6" 0f8700000000 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +d "jae 2" 7300 0x0 (branch (! (var cf)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +d "jae 6" 0f8300000000 0x0 (branch (! (var cf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +d "jb 2" 7200 0x0 (branch (var cf) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +d "jb 6" 0f8200000000 0x0 (branch (var cf) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +d "jbe 2" 7600 0x0 (branch (|| (var cf) (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +d "jbe 6" 0f8600000000 0x0 (branch (|| (var cf) (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +d "je 2" 7400 0x0 (branch (var zf) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +d "je 6" 0f8400000000 0x0 (branch (var zf) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +d "jg 2" 7f00 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +d "jg 6" 0f8f00000000 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +d "jge 2" 7d00 0x0 (branch (! (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +d "jge 6" 0f8d00000000 0x0 (branch (! (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +d "jl 2" 7c00 0x0 (branch (^^ (var sf) (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +d "jl 6" 0f8c00000000 0x0 (branch (^^ (var sf) (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +d "jle 2" 7e00 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +d "jle 6" 0f8e00000000 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) d "jmp 3" 66EB00 -d "jne 2" 7500 -d "jne 6" 0f8500000000 -d "jno 2" 7100 -d "jno 6" 0f8100000000 -d "jnp 2" 7b00 -d "jnp 6" 0f8b00000000 -d "jns 2" 7900 -d "jns 6" 0f8900000000 -d "jo 2" 7000 -d "jo 6" 0f8000000000 -d "jp 2" 7a00 -d "jp 6" 0f8a00000000 -d "js 2" 7800 -d "js 6" 0f8800000000 -d "lahf" 9F +d "jne 2" 7500 0x0 (branch (! (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +d "jne 6" 0f8500000000 0x0 (branch (! (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +d "jno 2" 7100 0x0 (branch (! (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +d "jno 6" 0f8100000000 0x0 (branch (! (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +d "jnp 2" 7b00 0x0 (branch (! (var pf)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +d "jnp 6" 0f8b00000000 0x0 (branch (! (var pf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +d "jns 2" 7900 0x0 (branch (! (var sf)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +d "jns 6" 0f8900000000 0x0 (branch (! (var sf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +d "jo 2" 7000 0x0 (branch (var of) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +d "jo 6" 0f8000000000 0x0 (branch (var of) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +d "jp 2" 7a00 0x0 (branch (var pf) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +d "jp 6" 0f8a00000000 0x0 (branch (var pf) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +d "js 2" 7800 0x0 (branch (var sf) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +d "js 6" 0f8800000000 0x0 (branch (var sf) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +d "jecxz 0x72" e308 0x68 (branch (is_zero (var ecx)) (jmp (+ (bv 32 0x68) (bv 32 0x72))) nop) +d "jcxz 0x4d" 67e308 0x42 (branch (is_zero (cast 16 false (var ecx))) (jmp (+ (bv 32 0x42) (bv 32 0x4d))) nop) +d "lahf" 9f 0x0 (set eax (| (& (var eax) (~ (bv 32 0xff00))) (<< (cast 32 false (| (<< (| (<< (| (<< (| (<< (| (<< (ite (var sf) (bv 8 0x1) (bv 8 0x0)) (bv 8 0x1) false) (ite (var zf) (bv 8 0x1) (bv 8 0x0))) (bv 8 0x2) false) (ite (var af) (bv 8 0x1) (bv 8 0x0))) (bv 8 0x2) false) (ite (var pf) (bv 8 0x1) (bv 8 0x0))) (bv 8 0x1) false) (bv 8 0x1)) (bv 8 0x1) false) (ite (var cf) (bv 8 0x1) (bv 8 0x0)))) (bv 8 0x8) false))) d "lar eax, word [eax]" 0f0200 d "lcall [0]" ff1c2500000000 d "lcall [eax]" ff18 d "lddqu xmm0, xmmword [eax]" f20ff000 d "ldmxcsr dword [eax]" 0fae10 -d "lds eax, [eax]" c500 -d "lea eax, [eax]" 8d00 -d "leave" C9 -d "les eax, [eax]" c400 +d "lds eax, [eax]" c500 0x0 (set eax (+ (+ (var eax) (bv 32 0x0)) (<< (cast 32 false (var ds)) (bv 8 0x4) false))) +d "lea eax, [eax]" 8d00 0x0 (set eax (+ (var eax) (bv 32 0x0))) +ad "leave" c9 0x0 (seq (set esp (var ebp)) (set esp (+ (var esp) (bv 32 0x4))) (set ebp (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false))))) +d "leave" 66c9 0x0 (seq (set esp (var ebp)) (set esp (+ (var esp) (bv 32 0x2))) (set ebp (| (& (var ebp) (~ (bv 32 0xffff))) (cast 32 false (loadw 0 16 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false))))))) +d "les eax, [eax]" c400 0x0 (set eax (+ (+ (var eax) (bv 32 0x0)) (<< (cast 32 false (var es)) (bv 8 0x4) false))) d "lfence" 0faee8 d "lgdt [eax]" 0f0110 d "lidt [eax]" 0f0118 @@ -226,68 +236,71 @@ d "lldt word [eax]" 0f0010 d "lmsw ax" 0f01f0 d "lmsw word [eax]" 0f0130 d "lock and word fs:[bx + si], si" 646766f02130 -d "lodsb al, byte [esi]" ac -d "lodsd eax, dword [esi]" ad -d "loop 3" 66e200 +d "lodsb al, byte [esi]" ac 0x0 (seq (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (loadw 0 8 (+ (+ (var esi) (bv 32 0x0)) (<< (cast 32 false (var ds)) (bv 8 0x4) false)))))) (branch (var df) (set esi (- (var esi) (bv 32 0x1))) (set esi (+ (var esi) (bv 32 0x1))))) +d "lodsd eax, dword [esi]" ad 0x0 (seq (set eax (loadw 0 32 (+ (+ (var esi) (bv 32 0x0)) (<< (cast 32 false (var ds)) (bv 8 0x4) false)))) (branch (var df) (set esi (- (var esi) (bv 32 0x4))) (set esi (+ (var esi) (bv 32 0x4))))) +d "lodsd eax, dword [si]" 67ad 0x0 (seq (set eax (loadw 0 32 (+ (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x0)) (<< (cast 32 false (var ds)) (bv 8 0x4) false)))) (branch (var df) (set esi (| (& (var esi) (~ (bv 32 0xffff))) (cast 32 false (- (cast 16 false (var esi)) (bv 16 0x4))))) (set esi (| (& (var esi) (~ (bv 32 0xffff))) (cast 32 false (+ (cast 16 false (var esi)) (bv 16 0x4))))))) +d "loop 3" 66e200 0x0 (seq (set ecx (- (var ecx) (bv 32 0x1))) (branch (! (is_zero (var ecx))) (jmp (bv 32 0x3)) nop)) +d "loope 3" 66e100 0x0 (seq (set ecx (- (var ecx) (bv 32 0x1))) (branch (&& (! (is_zero (var ecx))) (var zf)) (jmp (bv 32 0x3)) nop)) +d "loopne 3" 66e000 0x0 (seq (set ecx (- (var ecx) (bv 32 0x1))) (branch (&& (! (is_zero (var ecx))) (! (var zf))) (jmp (bv 32 0x3)) nop)) d "lsl eax, dword [eax]" 0f0300 d "ltr ax" 0f00d8 d "ltr word [eax]" 0f0018 d "lzcnt eax, dword [eax]" f30fbd00 d "mfence" 0faef0 d "monitor" 0f01c8 -d "mov ah, 0" B400 -d "mov ah, 0" b400 -d "mov al, 0" B000 -d "mov al, 0" b000 -d "mov al, byte [0]" a000000000 -d "mov al, byte [eax]" 8a00 -d "mov bh, 0" B700 -d "mov bh, 0" b700 -d "mov bl, 0" B300 -d "mov bl, 0" b300 -d "mov byte [0], al" a200000000 -d "mov byte [eax], 0" c60000 -d "mov byte [eax], al" 8800 -d "mov ch, 0" B500 -d "mov ch, 0" b500 -d "mov cl, 0" B100 -d "mov cl, 0" b100 -d "mov dh, 0" B600 -d "mov dh, 0" b600 -d "mov dl, 0" B200 -d "mov dl, 0" b200 -d "mov dr0, eax" 0f2300 -d "mov dword [0], eax" a300000000 -d "mov dword [eax], 0" c70000000000 -d "mov dword [eax], eax" 8900 -d "mov dword cs:[eax], eax" 2e8900 -d "mov dword ds:[eax], eax" 3e8900 -d "mov dword es:[eax], eax" 268900 -d "mov dword fs:[eax], eax" 648900 -d "mov dword gs:[eax], eax" 658900 -d "mov dword ss:[eax], eax" 368900 -d "mov eax, 0" b800000000 -d "mov eax, cr0" 0f2000 -d "mov eax, dr0" 0f2100 -d "mov cr0, eax" 0f2200 -d "mov eax, dword [0]" a100000000 -d "mov eax, dword [eax]" 8b00 -d "mov eax, dword [ebp]" 8b4500 -d "mov eax, dword [esp]" 8b0424 -d "mov eax, dword fs:[ebp]" 648b4500 -d "mov ebp, 0" bd00000000 -d "mov ebx, 0" bb00000000 -d "mov ecx, 0" b900000000 -d "mov edi, 0" bf00000000 -d "mov edx, 0" ba00000000 -d "mov es, word [eax]" 8e00 -d "mov esi, 0" be00000000 -d "mov esp, 0" bc00000000 -d "mov word [eax], es" 8c00 -a "mov al, [0xbeef]" a0efbe0000 -a "mov ax, [0xbeef]" 66a1efbe0000 -a "mov eax, [0xbeef]" a1efbe0000 -a "mov eax, [0x12345678]" a178563412 +d "mov ah, 0" b400 0x0 (set eax (| (& (var eax) (~ (bv 32 0xff00))) (<< (cast 32 false (bv 8 0x0)) (bv 8 0x8) false))) +d "mov ah, 0" b400 0x0 (set eax (| (& (var eax) (~ (bv 32 0xff00))) (<< (cast 32 false (bv 8 0x0)) (bv 8 0x8) false))) +d "mov al, 0" b000 0x0 (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (bv 8 0x0)))) +d "mov al, 0" b000 0x0 (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (bv 8 0x0)))) +d "mov al, byte [0]" a000000000 0x0 (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (loadw 0 8 (bv 32 0x0))))) +d "mov al, byte [eax]" 8a00 0x0 (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (loadw 0 8 (+ (var eax) (bv 32 0x0)))))) +d "mov bh, 0" b700 0x0 (set ebx (| (& (var ebx) (~ (bv 32 0xff00))) (<< (cast 32 false (bv 8 0x0)) (bv 8 0x8) false))) +d "mov bh, 0" b700 0x0 (set ebx (| (& (var ebx) (~ (bv 32 0xff00))) (<< (cast 32 false (bv 8 0x0)) (bv 8 0x8) false))) +d "mov bl, 0" b300 0x0 (set ebx (| (& (var ebx) (~ (bv 32 0xff))) (cast 32 false (bv 8 0x0)))) +d "mov bl, 0" b300 0x0 (set ebx (| (& (var ebx) (~ (bv 32 0xff))) (cast 32 false (bv 8 0x0)))) +d "mov byte [0], al" a200000000 0x0 (storew 0 (bv 32 0x0) (cast 8 false (var eax))) +d "mov byte [eax], 0" c60000 0x0 (storew 0 (+ (var eax) (bv 32 0x0)) (bv 8 0x0)) +d "mov byte [eax], al" 8800 0x0 (storew 0 (+ (var eax) (bv 32 0x0)) (cast 8 false (var eax))) +d "mov ch, 0" b500 0x0 (set ecx (| (& (var ecx) (~ (bv 32 0xff00))) (<< (cast 32 false (bv 8 0x0)) (bv 8 0x8) false))) +d "mov ch, 0" b500 0x0 (set ecx (| (& (var ecx) (~ (bv 32 0xff00))) (<< (cast 32 false (bv 8 0x0)) (bv 8 0x8) false))) +d "mov cl, 0" b100 0x0 (set ecx (| (& (var ecx) (~ (bv 32 0xff))) (cast 32 false (bv 8 0x0)))) +d "mov cl, 0" b100 0x0 (set ecx (| (& (var ecx) (~ (bv 32 0xff))) (cast 32 false (bv 8 0x0)))) +d "mov dh, 0" b600 0x0 (set edx (| (& (var edx) (~ (bv 32 0xff00))) (<< (cast 32 false (bv 8 0x0)) (bv 8 0x8) false))) +d "mov dh, 0" b600 0x0 (set edx (| (& (var edx) (~ (bv 32 0xff00))) (<< (cast 32 false (bv 8 0x0)) (bv 8 0x8) false))) +d "mov dl, 0" b200 0x0 (set edx (| (& (var edx) (~ (bv 32 0xff))) (cast 32 false (bv 8 0x0)))) +d "mov dl, 0" b200 0x0 (set edx (| (& (var edx) (~ (bv 32 0xff))) (cast 32 false (bv 8 0x0)))) +d "mov dr0, eax" 0f2300 0x0 (set dr0 (var eax)) +d "mov dword [0], eax" a300000000 0x0 (storew 0 (bv 32 0x0) (var eax)) +d "mov dword [eax], 0" c70000000000 0x0 (storew 0 (+ (var eax) (bv 32 0x0)) (bv 32 0x0)) +d "mov dword [eax], eax" 8900 0x0 (storew 0 (+ (var eax) (bv 32 0x0)) (var eax)) +d "mov dword cs:[eax], eax" 2e8900 0x0 (storew 0 (+ (+ (var eax) (bv 32 0x0)) (<< (cast 32 false (var cs)) (bv 8 0x4) false)) (var eax)) +d "mov dword ds:[eax], eax" 3e8900 0x0 (storew 0 (+ (+ (var eax) (bv 32 0x0)) (<< (cast 32 false (var ds)) (bv 8 0x4) false)) (var eax)) +d "mov dword es:[eax], eax" 268900 0x0 (storew 0 (+ (+ (var eax) (bv 32 0x0)) (<< (cast 32 false (var es)) (bv 8 0x4) false)) (var eax)) +d "mov dword fs:[eax], eax" 648900 0x0 (storew 0 (+ (+ (var eax) (bv 32 0x0)) (<< (cast 32 false (var fs)) (bv 8 0x4) false)) (var eax)) +d "mov dword gs:[eax], eax" 658900 0x0 (storew 0 (+ (+ (var eax) (bv 32 0x0)) (<< (cast 32 false (var gs)) (bv 8 0x4) false)) (var eax)) +d "mov dword ss:[eax], eax" 368900 0x0 (storew 0 (+ (+ (var eax) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (var eax)) +d "mov eax, 0" b800000000 0x0 (set eax (bv 32 0x0)) +d "mov eax, cr0" 0f2000 0x0 (set eax (var cr0)) +d "mov eax, dr0" 0f2100 0x0 (set eax (var dr0)) +d "mov cr0, eax" 0f2200 0x0 (set cr0 (var eax)) +d "mov eax, dword [0]" a100000000 0x0 (set eax (loadw 0 32 (bv 32 0x0))) +d "mov eax, dword [eax]" 8b00 0x0 (set eax (loadw 0 32 (+ (var eax) (bv 32 0x0)))) +d "mov eax, dword [ebp]" 8b4500 0x0 (set eax (loadw 0 32 (+ (var ebp) (bv 32 0x0)))) +d "mov eax, dword [esp]" 8b0424 0x0 (set eax (loadw 0 32 (+ (var esp) (bv 32 0x0)))) +d "mov eax, dword fs:[ebp]" 648b4500 0x0 (set eax (loadw 0 32 (+ (+ (var ebp) (bv 32 0x0)) (<< (cast 32 false (var fs)) (bv 8 0x4) false)))) +d "mov ebp, 0" bd00000000 0x0 (set ebp (bv 32 0x0)) +d "mov ebx, 0" bb00000000 0x0 (set ebx (bv 32 0x0)) +d "mov ecx, 0" b900000000 0x0 (set ecx (bv 32 0x0)) +d "mov edi, 0" bf00000000 0x0 (set edi (bv 32 0x0)) +d "mov edx, 0" ba00000000 0x0 (set edx (bv 32 0x0)) +d "mov es, word [eax]" 8e00 0x0 (set es (loadw 0 16 (+ (var eax) (bv 32 0x0)))) +d "mov esi, 0" be00000000 0x0 (set esi (bv 32 0x0)) +d "mov esp, 0" bc00000000 0x0 (set esp (bv 32 0x0)) +d "mov word [eax], es" 8c00 0x0 (storew 0 (+ (var eax) (bv 32 0x0)) (var es)) +a "mov al, [0xbeef]" a0efbe0000 0x0 (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (loadw 0 8 (bv 32 0xbeef))))) +a "mov ax, [0xbeef]" 66a1efbe0000 0x0 (set eax (| (& (var eax) (~ (bv 32 0xffff))) (cast 32 false (loadw 0 16 (bv 32 0xbeef))))) +a "mov eax, [0xbeef]" a1efbe0000 0x0 (set eax (loadw 0 32 (bv 32 0xbeef))) +a "mov eax, [0x12345678]" a178563412 0x0 (set eax (loadw 0 32 (bv 32 0x12345678))) d "movapd xmm0, xmmword [eax]" 660f2800 d "movapd xmmword [eax], xmm0" 660f2900 d "movhpd qword [eax], xmm0" 660f1700 @@ -298,9 +311,9 @@ d "movntdq xmmword [eax], xmm0" 660fe700 d "movnti dword [eax], eax" 0fc300 d "movntq qword [eax], mm0" 0fe700 d "movq qword [eax], xmm0" 660fd600 -d "movsb byte es:[edi], byte ptr [esi]" a4 -d "movsd dword es:[edi], dword ptr [esi]" a5 -d "movsd dword es:[edi], dword ptr fs:[esi]" 64a5 +d "movsb byte es:[edi], byte ptr [esi]" a4 0x0 (seq (storew 0 (+ (+ (var edi) (bv 32 0x0)) (<< (cast 32 false (var es)) (bv 8 0x4) false)) (loadw 0 8 (+ (+ (var esi) (bv 32 0x0)) (<< (cast 32 false (var ds)) (bv 8 0x4) false)))) (branch (var df) (seq (set esi (- (var esi) (bv 32 0x1))) (set edi (- (var edi) (bv 32 0x1)))) (seq (set esi (+ (var esi) (bv 32 0x1))) (set edi (+ (var edi) (bv 32 0x1)))))) +d "movsd dword es:[edi], dword ptr [esi]" a5 0x0 (seq (storew 0 (+ (+ (var edi) (bv 32 0x0)) (<< (cast 32 false (var es)) (bv 8 0x4) false)) (loadw 0 32 (+ (+ (var esi) (bv 32 0x0)) (<< (cast 32 false (var ds)) (bv 8 0x4) false)))) (branch (var df) (seq (set esi (- (var esi) (bv 32 0x4))) (set edi (- (var edi) (bv 32 0x4)))) (seq (set esi (+ (var esi) (bv 32 0x4))) (set edi (+ (var edi) (bv 32 0x4)))))) +d "movsd dword es:[edi], dword ptr fs:[esi]" 64a5 0x0 (seq (storew 0 (+ (+ (var edi) (bv 32 0x0)) (<< (cast 32 false (var es)) (bv 8 0x4) false)) (loadw 0 32 (+ (+ (var esi) (bv 32 0x0)) (<< (cast 32 false (var ds)) (bv 8 0x4) false)))) (branch (var df) (seq (set esi (- (var esi) (bv 32 0x4))) (set edi (- (var edi) (bv 32 0x4)))) (seq (set esi (+ (var esi) (bv 32 0x4))) (set edi (+ (var edi) (bv 32 0x4)))))) d "movshdup xmm0, xmmword [eax]" f30f1600 d "movsldup xmm0, xmmword [eax]" f30f1200 d "movss dword [eax], xmm0" f30f1100 @@ -311,28 +324,28 @@ d "movupd xmm0, xmmword [eax]" 660f1000 d "movupd xmmword [eax], xmm0" 660f1100 d "movzx eax, byte [eax]" 0fb600 d "movzx eax, word [eax]" 0fb700 -ad "mov byte [esp + eax + 0xf], 0" c644040f00 -ad "mov byte [eax + ecx + 0xf], 0" c644080f00 -ad "mov byte [edx + ecx + 2], 4" c6440a0204 -d "mul byte [eax]" f620 +ad "mov byte [esp + eax + 0xf], 0" c644040f00 0x0 (storew 0 (+ (+ (var esp) (* (var eax) (bv 32 0x1))) (bv 32 0xf)) (bv 8 0x0)) +ad "mov byte [eax + ecx + 0xf], 0" c644080f00 0x0 (storew 0 (+ (+ (var eax) (* (var ecx) (bv 32 0x1))) (bv 32 0xf)) (bv 8 0x0)) +ad "mov byte [edx + ecx + 2], 4" c6440a0204 0x0 (storew 0 (+ (+ (var edx) (* (var ecx) (bv 32 0x1))) (bv 32 0x2)) (bv 8 0x4)) d "mulsd xmm0, qword [eax]" f20f5900 d "mulss xmm0, dword [eax]" f30f5900 d "mwait" 0f01c9 -d "neg byte [eax]" f618 -d "neg eax" f7d8 -a "neg eax" f7d8 -d "nop" 90 -d "not byte [eax]" f610 -d "not al" f6d0 -d "or al, 0" 0c00 -d "or byte [eax], al" 0800 -d "or dword [eax], eax" 0900 -d "or eax, dword [eax]" 0b00 -d "out 0, al" E600 -d "out 0, eax" E700 -d "out 0x84, eax" e784 -ad "out dx, al" ee -ad "out dx, eax" ef +ad "wait" 9b 0x0 nop +d "neg byte [eax]" f618 0x0 (seq (set _op (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (branch (is_zero (var _op)) (set cf false) (set cf true)) (storew 0 (+ (var eax) (bv 32 0x0)) (~- (var _op)))) +d "neg eax" f7d8 0x0 (seq (set _op (var eax)) (branch (is_zero (var _op)) (set cf false) (set cf true)) (set eax (~- (var _op)))) +a "neg eax" f7d8 0x0 (seq (set _op (var eax)) (branch (is_zero (var _op)) (set cf false) (set cf true)) (set eax (~- (var _op)))) +ad "nop" 90 0x0 nop +d "not byte [eax]" f610 0x0 (storew 0 (+ (var eax) (bv 32 0x0)) (~ (loadw 0 8 (+ (var eax) (bv 32 0x0))))) +d "not al" f6d0 0x0 (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (~ (cast 8 false (var eax)))))) +d "or al, 0" 0c00 0x0 (seq (set _or (| (cast 8 false (var eax)) (bv 8 0x0))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _or)))) (set of false) (set cf false) (set _result (var _or)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "or byte [eax], al" 0800 0x0 (seq (set _or (| (loadw 0 8 (+ (var eax) (bv 32 0x0))) (cast 8 false (var eax)))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _or)) (set of false) (set cf false) (set _result (var _or)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "or dword [eax], eax" 0900 0x0 (seq (set _or (| (loadw 0 32 (+ (var eax) (bv 32 0x0))) (var eax))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _or)) (set of false) (set cf false) (set _result (var _or)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "or eax, dword [eax]" 0b00 0x0 (seq (set _or (| (var eax) (loadw 0 32 (+ (var eax) (bv 32 0x0))))) (set eax (var _or)) (set of false) (set cf false) (set _result (var _or)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "out 0, al" e600 0x0 (seq (goto port) empty) +d "out 0, eax" e700 0x0 (seq (goto port) empty) +d "out 0x84, eax" e784 0x0 (seq (goto port) empty) +ad "out dx, al" ee 0x0 (seq (goto port) empty) +ad "out dx, eax" ef 0x0 (seq (goto port) empty) d "outsb dx, byte [esi]" 6e d "outsd dx, dword [esi]" 6f d "paddq xmm0, xmmword [eax]" 660fd400 @@ -357,23 +370,23 @@ d "pmaxsw mm0, qword [eax]" 0fee00 d "pmaxub mm0, qword [eax]" 0fde00 d "pminsw mm0, qword [eax]" 0fea00 d "pminub mm0, qword [eax]" 0fda00 -d "pop ds" 1F -d "pop dword [eax]" 8f00 -d "pop eax" 58 -d "pop ebp" 5D -d "pop ebx" 5B -d "pop ecx" 59 -d "pop edi" 5F -d "pop edx" 5A -d "pop es" 07 -d "pop esi" 5E -d "pop esp" 5C -d "pop fs" 0fa1 -d "pop gs" 0fa9 -d "pop ss" 17 +d "pop ds" 1f 0x0 (seq (set ds (loadw 0 16 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x2)))) +d "pop dword [eax]" 8f00 0x0 (seq (storew 0 (+ (var eax) (bv 32 0x0)) (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +d "pop eax" 58 0x0 (seq (set eax (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +d "pop ebp" 5d 0x0 (seq (set ebp (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +d "pop ebx" 5b 0x0 (seq (set ebx (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +d "pop ecx" 59 0x0 (seq (set ecx (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +d "pop edi" 5f 0x0 (seq (set edi (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +d "pop edx" 5a 0x0 (seq (set edx (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +d "pop es" 07 0x0 (seq (set es (loadw 0 16 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x2)))) +d "pop esi" 5e 0x0 (seq (set esi (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +d "pop esp" 5c 0x0 (seq (set esp (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +d "pop fs" 0fa1 0x0 (seq (set fs (loadw 0 16 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x2)))) +d "pop gs" 0fa9 0x0 (seq (set gs (loadw 0 16 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x2)))) +d "pop ss" 17 0x0 (seq (set ss (loadw 0 16 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x2)))) d "popal" 61 d "popaw" 6661 -d "popfd" 9D +d "popfd" 9d 0x0 (seq (set _flags (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set cf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set pf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set af (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set zf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set sf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set tf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set if (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set df (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set of (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x3) false)) (set nt (lsb (var _flags))) (set esp (+ (var esp) (bv 32 0x4)))) d "por mm0, qword [eax]" 0feb00 d "prefetchnta byte [eax]" 0f1800 d "prefetcht0 byte [eax]" 0f1808 @@ -393,33 +406,33 @@ d "psubusb mm0, qword [eax]" 0fd800 d "psubusw mm0, qword [eax]" 0fd900 d "punpckhqdq xmm0, xmmword [eax]" 660f6d00 d "punpcklqdq xmm0, xmmword [eax]" 660f6c00 -d "push 0" 6a00 -d "push cs" 0E -d "push ds" 1E -d "push dword [eax]" ff30 -d "push eax" 50 -d "push ebp" 55 -d "push ebx" 53 -d "push ecx" 51 -d "push edi" 57 -d "push edx" 52 -d "push es" 06 -d "push esi" 56 -d "push esp" 54 -d "push fs" 0fa0 -d "push gs" 0fa8 -d "push ss" 16 -d "pushal" 60 -d "pushfd" 9C +d "push 0" 6a00 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (bv 32 0x0)))) +d "push cs" 0e 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var cs)))) +d "push ds" 1e 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var ds)))) +d "push dword [eax]" ff30 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (loadw 0 32 (+ (var eax) (bv 32 0x0)))))) +d "push eax" 50 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var eax)))) +d "push ebp" 55 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var ebp)))) +d "push ebx" 53 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var ebx)))) +d "push ecx" 51 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var ecx)))) +d "push edi" 57 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var edi)))) +d "push edx" 52 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var edx)))) +d "push es" 06 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var es)))) +d "push esi" 56 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var esi)))) +d "push esp" 54 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var esp)))) +d "push fs" 0fa0 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var fs)))) +d "push gs" 0fa8 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var gs)))) +d "push ss" 16 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var ss)))) +d "pushal" 60 0x0 (seq (set _esp (var esp)) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var eax))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var ecx))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var edx))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var ebx))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _esp))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var ebp))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var esi))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var edi)))) +d "pushfd" 9c 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (ite false (bv 32 0x1) (bv 32 0x0)) (bv 32 0x1) false) (ite (var nt) (bv 32 0x1) (bv 32 0x0))) (bv 32 0x2) false) (bv 32 0x3)) (bv 32 0x1) false) (ite (var of) (bv 32 0x1) (bv 32 0x0))) (bv 32 0x1) false) (ite (var df) (bv 32 0x1) (bv 32 0x0))) (bv 32 0x1) false) (ite (var if) (bv 32 0x1) (bv 32 0x0))) (bv 32 0x1) false) (ite (var tf) (bv 32 0x1) (bv 32 0x0))) (bv 32 0x1) false) (ite (var zf) (bv 32 0x1) (bv 32 0x0))) (bv 32 0x1) false) (ite (var zf) (bv 32 0x1) (bv 32 0x0))) (bv 32 0x2) false) (ite (var af) (bv 32 0x1) (bv 32 0x0))) (bv 32 0x2) false) (ite (var pf) (bv 32 0x1) (bv 32 0x0))) (bv 32 0x1) false) (bv 32 0x1)) (bv 32 0x1) false) (ite (var cf) (bv 32 0x1) (bv 32 0x0)))))) d "pxor mm0, qword [eax]" 0fef00 d "rdmsr" 0f32 d "rdpmc" 0f33 d "rdtsc" 0f31 d "rdtscp" 0f01f9 d "repne movsb byte es:[edi], byte ptr [esi]" f2a4 -d "ret" C3 -d "retf 0" CA0000 -d "retf" CB +d "ret" c3 0x0 (seq (set esp (+ (var esp) (bv 32 0x4))) (set esp (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false))))) +d "retf 0" ca0000 0x0 empty +d "retf" cb 0x0 empty d "rol byte [eax], 0" c00000 d "rol byte [eax], 1" d000 d "rol byte [eax], cl" d200 @@ -427,15 +440,16 @@ d "rol dword [eax], 0" c10000 d "rol dword [eax], 1" d100 d "rol dword [eax], cl" d300 d "rsm" 0faa -d "sahf" 9E +ad "sahf" 9e 0x0 (seq (set _flags (cast 8 false (>> (var eax) (bv 8 0x8) false))) (set cf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set pf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set af (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set zf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set sf (lsb (var _flags)))) d "salc" D6 -d "sbb al, 0" 1c00 -d "sbb al, byte [eax]" 1a00 -d "sbb byte [eax], al" 1800 -d "sbb dword [eax], eax" 1900 -d "sbb eax, dword [eax]" 1b00 -d "scasb al, byte es:[edi]" ae -d "scasd eax, dword es:[edi]" af +ad "sbb al, 0" 1c00 0x0 (seq (set _op1 (cast 8 false (var eax))) (set _op2 (bv 8 0x0)) (set _diff (- (- (var _op1) (var _op2)) (ite (var cf) (bv 8 0x1) (bv 8 0x0)))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _diff)))) (set _result (var _diff)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _diff)) (set _x (var _op1)) (set _y (var _op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +ad "sbb al, byte [eax]" 1a00 0x0 (seq (set _op1 (cast 8 false (var eax))) (set _op2 (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set _diff (- (- (var _op1) (var _op2)) (ite (var cf) (bv 8 0x1) (bv 8 0x0)))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _diff)))) (set _result (var _diff)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _diff)) (set _x (var _op1)) (set _y (var _op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +ad "sbb byte [eax], al" 1800 0x0 (seq (set _op1 (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set _op2 (cast 8 false (var eax))) (set _diff (- (- (var _op1) (var _op2)) (ite (var cf) (bv 8 0x1) (bv 8 0x0)))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _diff)) (set _result (var _diff)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _diff)) (set _x (var _op1)) (set _y (var _op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +ad "sbb dword [eax], eax" 1900 0x0 (seq (set _op1 (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set _op2 (var eax)) (set _diff (- (- (var _op1) (var _op2)) (ite (var cf) (bv 32 0x1) (bv 32 0x0)))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _diff)) (set _result (var _diff)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _diff)) (set _x (var _op1)) (set _y (var _op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +ad "sbb eax, dword [eax]" 1b00 0x0 (seq (set _op1 (var eax)) (set _op2 (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set _diff (- (- (var _op1) (var _op2)) (ite (var cf) (bv 32 0x1) (bv 32 0x0)))) (set eax (var _diff)) (set _result (var _diff)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _diff)) (set _x (var _op1)) (set _y (var _op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +ad "scasb al, byte es:[edi]" ae 0x0 (seq (set _reg (cast 8 false (var eax))) (set _src (loadw 0 8 (+ (+ (var edi) (bv 32 0x0)) (<< (cast 32 false (var es)) (bv 8 0x4) false)))) (set _temp (- (var _reg) (var _src))) (set _result (var _temp)) (set _x (var _reg)) (set _y (var _src)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var _temp)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (branch (var df) (set edi (- (var edi) (bv 32 0x1))) (set edi (+ (var edi) (bv 32 0x1))))) +ad "scasd eax, dword es:[edi]" af 0x0 (seq (set _reg (var eax)) (set _src (loadw 0 32 (+ (+ (var edi) (bv 32 0x0)) (<< (cast 32 false (var es)) (bv 8 0x4) false)))) (set _temp (- (var _reg) (var _src))) (set _result (var _temp)) (set _x (var _reg)) (set _y (var _src)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var _temp)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (branch (var df) (set edi (- (var edi) (bv 32 0x4))) (set edi (+ (var edi) (bv 32 0x4))))) +d "scasd eax, dword es:[di]" 67af 0x0 (seq (set _reg (var eax)) (set _src (loadw 0 32 (+ (+ (cast 32 false (cast 16 false (var edi))) (bv 32 0x0)) (<< (cast 32 false (var es)) (bv 8 0x4) false)))) (set _temp (- (var _reg) (var _src))) (set _result (var _temp)) (set _x (var _reg)) (set _y (var _src)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var _temp)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (branch (var df) (set edi (| (& (var edi) (~ (bv 32 0xffff))) (cast 32 false (- (cast 16 false (var edi)) (bv 16 0x4))))) (set edi (| (& (var edi) (~ (bv 32 0xffff))) (cast 32 false (+ (cast 16 false (var edi)) (bv 16 0x4))))))) d "seta byte [eax]" 660f9700 d "setae byte [eax]" 660f9300 d "setb byte [eax]" 660f9200 @@ -465,34 +479,36 @@ d "sldt word [eax]" 0f0000 d "smsw ax" 660f01e0 d "smsw eax" 0f01e0 d "smsw word [eax]" 0f0120 -d "stc" F9 -d "std" FD +d "stac" 0f01cb 0x0 (set ac true) +ad "stc" f9 0x0 (set cf true) +ad "std" fd 0x0 (set df true) d "stgi" 0f01dc -d "sti" FB +ad "sti" fb 0x0 (set if true) d "stmxcsr dword [eax]" 0fae18 -d "stosb byte es:[edi], al" aa -d "stosd dword es:[edi], eax" ab +ad "stosb byte es:[edi], al" aa 0x0 (seq (storew 0 (+ (+ (var edi) (bv 32 0x0)) (<< (cast 32 false (var es)) (bv 8 0x4) false)) (cast 8 false (var eax))) (branch (var df) (set edi (- (var edi) (bv 32 0x1))) (set edi (+ (var edi) (bv 32 0x1))))) +ad "stosd dword es:[edi], eax" ab 0x0 (seq (storew 0 (+ (+ (var edi) (bv 32 0x0)) (<< (cast 32 false (var es)) (bv 8 0x4) false)) (var eax)) (branch (var df) (set edi (- (var edi) (bv 32 0x4))) (set edi (+ (var edi) (bv 32 0x4))))) +d "stosd dword es:[di], eax" 67ab 0x0 (seq (storew 0 (+ (+ (cast 32 false (cast 16 false (var edi))) (bv 32 0x0)) (<< (cast 32 false (var es)) (bv 8 0x4) false)) (var eax)) (branch (var df) (set edi (| (& (var edi) (~ (bv 32 0xffff))) (cast 32 false (- (cast 16 false (var edi)) (bv 16 0x4))))) (set edi (| (& (var edi) (~ (bv 32 0xffff))) (cast 32 false (+ (cast 16 false (var edi)) (bv 16 0x4))))))) d "str word [eax]" 0f0008 -d "sub al, 0" 2c00 -d "sub al, byte [eax]" 2a00 -d "sub byte [eax], al" 2800 -d "sub dword [eax], eax" 2900 -d "sub eax, dword [eax]" 2b00 +d "sub al, 0" 2c00 0x0 (seq (set op1 (cast 8 false (var eax))) (set op2 (bv 8 0x0)) (set sub (- (var op1) (var op2))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var sub)))) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +d "sub al, byte [eax]" 2a00 0x0 (seq (set op1 (cast 8 false (var eax))) (set op2 (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set sub (- (var op1) (var op2))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var sub)))) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +d "sub byte [eax], al" 2800 0x0 (seq (set op1 (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set op2 (cast 8 false (var eax))) (set sub (- (var op1) (var op2))) (storew 0 (+ (var eax) (bv 32 0x0)) (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +d "sub dword [eax], eax" 2900 0x0 (seq (set op1 (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set op2 (var eax)) (set sub (- (var op1) (var op2))) (storew 0 (+ (var eax) (bv 32 0x0)) (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +d "sub eax, dword [eax]" 2b00 0x0 (seq (set op1 (var eax)) (set op2 (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set sub (- (var op1) (var op2))) (set eax (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) d "subsd xmm0, qword [eax]" f20f5c00 d "subss xmm0, dword [eax]" f30f5c00 d "syscall" 0f05 d "sysenter" 0f34 d "sysexit" 0f35 d "sysret" 0f07 -d "test al, 0" a800 -d "test byte [eax], 0" f60000 -d "test byte [eax], 0" f60800 -d "test byte [eax], al" 8400 -d "test dword [eax], 0" f70000000000 -d "test dword [eax], 0" f70000000000 -d "test dword [eax], 0" f70800000000 -d "test dword [eax], eax" 8500 -d "test eax, 0" a900000000 +d "test al, 0" a800 0x0 (seq (set _res (& (cast 8 false (var eax)) (bv 8 0x0))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _res)))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +d "test byte [eax], 0" f60000 0x0 (seq (set _res (& (loadw 0 8 (+ (var eax) (bv 32 0x0))) (bv 8 0x0))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +d "test byte [eax], 0" f60800 0x0 (seq (set _res (& (loadw 0 8 (+ (var eax) (bv 32 0x0))) (bv 8 0x0))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +d "test byte [eax], al" 8400 0x0 (seq (set _res (& (loadw 0 8 (+ (var eax) (bv 32 0x0))) (cast 8 false (var eax)))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +d "test dword [eax], 0" f70000000000 0x0 (seq (set _res (& (loadw 0 32 (+ (var eax) (bv 32 0x0))) (bv 32 0x0))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +d "test dword [eax], 0" f70000000000 0x0 (seq (set _res (& (loadw 0 32 (+ (var eax) (bv 32 0x0))) (bv 32 0x0))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +d "test dword [eax], 0" f70800000000 0x0 (seq (set _res (& (loadw 0 32 (+ (var eax) (bv 32 0x0))) (bv 32 0x0))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +d "test dword [eax], eax" 8500 0x0 (seq (set _res (& (loadw 0 32 (+ (var eax) (bv 32 0x0))) (var eax))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +d "test eax, 0" a900000000 0x0 (seq (set _res (& (var eax) (bv 32 0x0))) (set eax (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) d "ud2" 0f0b d "unpckhpd xmm0, xmmword [eax]" 660f1500 d "unpcklpd xmm0, xmmword [eax]" 660f1400 @@ -515,23 +531,23 @@ d "wbinvd" 0f09 d "wrmsr" 0f30 d "xadd byte [eax], al" 0fc000 d "xadd dword [eax], eax" 0fc100 -d "xchg byte [eax], al" 8600 -d "xchg dword [eax], eax" 8700 -d "xchg eax, ebp" 95 -d "xchg eax, ebx" 93 -d "xchg eax, ecx" 91 -d "xchg eax, edi" 97 -d "xchg eax, edx" 92 -d "xchg eax, esi" 96 -d "xchg eax, esp" 94 +d "xchg byte [eax], al" 8600 0x0 (seq (set _temp (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (storew 0 (+ (var eax) (bv 32 0x0)) (cast 8 false (var eax))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _temp))))) +d "xchg dword [eax], eax" 8700 0x0 (seq (set _temp (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (storew 0 (+ (var eax) (bv 32 0x0)) (var eax)) (set eax (var _temp))) +d "xchg eax, ebp" 95 0x0 (seq (set _temp (var eax)) (set eax (var ebp)) (set ebp (var _temp))) +d "xchg eax, ebx" 93 0x0 (seq (set _temp (var eax)) (set eax (var ebx)) (set ebx (var _temp))) +d "xchg eax, ecx" 91 0x0 (seq (set _temp (var eax)) (set eax (var ecx)) (set ecx (var _temp))) +d "xchg eax, edi" 97 0x0 (seq (set _temp (var eax)) (set eax (var edi)) (set edi (var _temp))) +d "xchg eax, edx" 92 0x0 (seq (set _temp (var eax)) (set eax (var edx)) (set edx (var _temp))) +d "xchg eax, esi" 96 0x0 (seq (set _temp (var eax)) (set eax (var esi)) (set esi (var _temp))) +d "xchg eax, esp" 94 0x0 (seq (set _temp (var eax)) (set eax (var esp)) (set esp (var _temp))) d "xgetbv" 0f01d0 -d "xlatb" D7 -d "xor al, 0" 3400 -d "xor al, byte [eax]" 3200 -d "xor byte [eax], al" 3000 -d "xor byte [eax], 0xff" 8030FF -d "xor dword [eax], eax" 3100 -d "xor eax, dword [eax]" 3300 +ad "xlatb" d7 0x0 (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (loadw 0 8 (+ (+ (+ (var ebx) (bv 32 0x0)) (<< (cast 32 false (var ds)) (bv 8 0x4) false)) (cast 32 false (cast 8 false (var eax)))))))) +d "xor al, 0" 3400 0x0 (seq (set _xor (^ (cast 8 false (var eax)) (bv 8 0x0))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _xor)))) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "xor al, byte [eax]" 3200 0x0 (seq (set _xor (^ (cast 8 false (var eax)) (loadw 0 8 (+ (var eax) (bv 32 0x0))))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _xor)))) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "xor byte [eax], al" 3000 0x0 (seq (set _xor (^ (loadw 0 8 (+ (var eax) (bv 32 0x0))) (cast 8 false (var eax)))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "xor byte [eax], 0xff" 8030ff 0x0 (seq (set _xor (^ (loadw 0 8 (+ (var eax) (bv 32 0x0))) (bv 8 0xff))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "xor dword [eax], eax" 3100 0x0 (seq (set _xor (^ (loadw 0 32 (+ (var eax) (bv 32 0x0))) (var eax))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "xor eax, dword [eax]" 3300 0x0 (seq (set _xor (^ (var eax) (loadw 0 32 (+ (var eax) (bv 32 0x0))))) (set eax (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) d "xrstor [eax]" 0fae28 d "xsave [eax]" 0fae20 d "xsetbv" 0f01d1 @@ -802,8 +818,8 @@ d "vfnmsubpd ymm0, ymm0, ymm0, ymm0" c4e37d7dc000 d "vfnmsubps ymm0, ymm0, ymm0, ymm0" c4e37d7cc000 d "vfnmsubss xmm0, xmm0, xmm0, xmm0" c4e3797ec000 d "vfnmsubsd xmm0, xmm0, xmm0, xmm0" c4e3797fc000 -d "movsd xmm0, qword [eax]" f20f1000 -d "movsd qword [eax], xmm0" f20f1100 +d "movsd xmm0, qword [eax]" f20f1000 0x0 (seq (storew 0 (+ (+ (var edi) (bv 32 0x0)) (<< (cast 32 false (var es)) (bv 8 0x4) false)) (loadw 0 32 (+ (+ (var esi) (bv 32 0x0)) (<< (cast 32 false (var ds)) (bv 8 0x4) false)))) (branch (var df) (seq (set esi (- (var esi) (bv 32 0x4))) (set edi (- (var edi) (bv 32 0x4)))) (seq (set esi (+ (var esi) (bv 32 0x4))) (set edi (+ (var edi) (bv 32 0x4)))))) +d "movsd qword [eax], xmm0" f20f1100 0x0 (seq (storew 0 (+ (+ (var edi) (bv 32 0x0)) (<< (cast 32 false (var es)) (bv 8 0x4) false)) (loadw 0 32 (+ (+ (var esi) (bv 32 0x0)) (<< (cast 32 false (var ds)) (bv 8 0x4) false)))) (branch (var df) (seq (set esi (- (var esi) (bv 32 0x4))) (set edi (- (var edi) (bv 32 0x4)))) (seq (set esi (+ (var esi) (bv 32 0x4))) (set edi (+ (var edi) (bv 32 0x4)))))) d "movddup xmm0, qword [eax]" f20f1200 d "cvtps2pd xmm0, qword [eax]" 0f5a00 d "cvtpd2ps xmm0, xmmword [eax]" 660f5a00 @@ -1047,11 +1063,11 @@ aB "bt edx, 59" 0fbae23b aB "bt ebp, -20" 0fbae5e0 aB "btr dword [eax], eax" 0fb300 aB "bts dword [eax], eax" 0fab00 -a "call 0x8049100" e8fb900408 -a "call 4" e8ffffffff -a "call 5" e800000000 -a "call dword [eax]" ff10 -a "call ebx" ffd3 +a "call 0x8049100" e8fb900408 0x0 (seq (set _cs (cast 32 false (var cs))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _cs))) (set _pc (bv 32 0x0)) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _pc)))) +a "call 4" e8ffffffff 0x0 (seq (set _cs (cast 32 false (var cs))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _cs))) (set _pc (bv 32 0x0)) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _pc)))) +a "call 5" e800000000 0x0 (seq (set _cs (cast 32 false (var cs))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _cs))) (set _pc (bv 32 0x0)) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _pc)))) +a "call dword [eax]" ff10 0x0 (seq (set _cs (cast 32 false (var cs))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _cs))) (set _pc (bv 32 0x0)) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _pc)))) +a "call ebx" ffd3 0x0 (seq (set _cs (cast 32 false (var cs))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _cs))) (set _pc (bv 32 0x0)) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _pc)))) a "bnd call ebx" f2ffd3 a "cbw" 6698 a "cdq" 99 @@ -1139,8 +1155,9 @@ aB "cmpordpd xmm0, xmmword [eax]" 660fc20007 aB "cmpordps xmm0, xmmword [eax]" 0fc20007 aB "cmpordsd xmm0, qword [eax]" f20fc20007 aB "cmpordss xmm0, dword [eax]" f30fc20007 -a "cmpsb byte [esi], byte ptr es:[edi]" a6 -a "cmpsd dword [esi], dword ptr es:[edi]" a7 +ad "cmpsb byte [esi], byte ptr es:[edi]" a6 0x0 (seq (set _src1 (loadw 0 8 (+ (+ (var esi) (bv 32 0x0)) (<< (cast 32 false (var ds)) (bv 8 0x4) false)))) (set _src2 (loadw 0 8 (+ (+ (var edi) (bv 32 0x0)) (<< (cast 32 false (var es)) (bv 8 0x4) false)))) (set _temp (- (var _src1) (var _src2))) (set _result (var _temp)) (set _x (var _src1)) (set _y (var _src2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var _temp)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (branch (var df) (seq (set esi (+ (var esi) (bv 32 0x1))) (set edi (+ (var edi) (bv 32 0x1)))) (seq (set esi (- (var esi) (bv 32 0x1))) (set edi (- (var edi) (bv 32 0x1)))))) +ad "cmpsd dword [esi], dword ptr es:[edi]" a7 0x0 (seq (set _src1 (loadw 0 32 (+ (+ (var esi) (bv 32 0x0)) (<< (cast 32 false (var ds)) (bv 8 0x4) false)))) (set _src2 (loadw 0 32 (+ (+ (var edi) (bv 32 0x0)) (<< (cast 32 false (var es)) (bv 8 0x4) false)))) (set _temp (- (var _src1) (var _src2))) (set _result (var _temp)) (set _x (var _src1)) (set _y (var _src2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var _temp)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (branch (var df) (seq (set esi (+ (var esi) (bv 32 0x4))) (set edi (+ (var edi) (bv 32 0x4)))) (seq (set esi (- (var esi) (bv 32 0x4))) (set edi (- (var edi) (bv 32 0x4)))))) +d "cmpsd dword [si], dword ptr es:[di]" 67a7 0x0 (seq (set _src1 (loadw 0 32 (+ (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x0)) (<< (cast 32 false (var ds)) (bv 8 0x4) false)))) (set _src2 (loadw 0 32 (+ (+ (cast 32 false (cast 16 false (var edi))) (bv 32 0x0)) (<< (cast 32 false (var es)) (bv 8 0x4) false)))) (set _temp (- (var _src1) (var _src2))) (set _result (var _temp)) (set _x (var _src1)) (set _y (var _src2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var _temp)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (branch (var df) (seq (set esi (| (& (var esi) (~ (bv 32 0xffff))) (cast 32 false (+ (cast 16 false (var esi)) (bv 16 0x4))))) (set edi (| (& (var edi) (~ (bv 32 0xffff))) (cast 32 false (+ (cast 16 false (var edi)) (bv 16 0x4)))))) (seq (set esi (| (& (var esi) (~ (bv 32 0xffff))) (cast 32 false (- (cast 16 false (var esi)) (bv 16 0x4))))) (set edi (| (& (var edi) (~ (bv 32 0xffff))) (cast 32 false (- (cast 16 false (var edi)) (bv 16 0x4)))))))) aB "cmpsd xmm0, qword [eax]" f20fc20000 aB "cmpunordpd xmm0, xmmword [eax]" 660fc20003 aB "cmpunordps xmm0, xmmword [eax]" 0fc20003 @@ -1213,145 +1230,145 @@ a "hlt" f4 aB "hsubpd xmm0, xmmword [eax]" 660f7d00 aB "hsubps xmm0, xmmword [eax]" f20f7d00 a "idiv byte [eax]" f638 -a "imul eax" f7e8 -a "imul edx" f7ea -a "imul edx, eax" 0fafd0 -a "imul ecx, 23" 6bc917 -a "imul edx, ecx, 34" 6bd122 -a "imul byte [eax]" f628 -a "imul dword [eax]" f728 -a "imul ebx, [edx + ecx]" 0faf1c0a -a "imul ebx, dword [edx], 0" 6b1a00 -a "imul ebx, edx, 4" 6bda04 -a "imul eax, dword [eax]" 0faf00 -a "imul eax, [eax], 0" 6b0000 -a "in al,0" e400 -a "in al,dx" ec -a "inc byte [eax]" fe00 -a "inc dword [eax]" ff00 -a "inc eax" 40 -a "inc ebp" 45 -a "inc ebx" 43 -a "inc ecx" 41 -a "inc edi" 47 -a "inc edx" 42 -a "inc esi" 46 -a "inc esp" 44 -a "in eax, 0" e500 -a "in eax, 0x8c" e58c -a "in eax, dx" ed +a "imul eax" f7e8 0x0 (seq (set _tmp_xp (* (cast 64 (msb (var eax)) (var eax)) (cast 64 (msb (var eax)) (var eax)))) (set eax (cast 32 false (var _tmp_xp))) (set edx (cast 32 false (>> (var _tmp_xp) (bv 8 0x20) false))) (branch (== (cast 64 (msb (cast 32 false (var _tmp_xp))) (cast 32 false (var _tmp_xp))) (var _tmp_xp)) (seq (set cf false) (set of false)) (seq (set cf true) (set of true)))) +a "imul edx" f7ea 0x0 (seq (set _tmp_xp (* (cast 64 (msb (var eax)) (var eax)) (cast 64 (msb (var edx)) (var edx)))) (set eax (cast 32 false (var _tmp_xp))) (set edx (cast 32 false (>> (var _tmp_xp) (bv 8 0x20) false))) (branch (== (cast 64 (msb (cast 32 false (var _tmp_xp))) (cast 32 false (var _tmp_xp))) (var _tmp_xp)) (seq (set cf false) (set of false)) (seq (set cf true) (set of true)))) +a "imul edx, eax" 0fafd0 0x0 (seq (set _dest (var edx)) (set _tmp_xp (* (cast 64 (msb (var _dest)) (var _dest)) (cast 64 (msb (var eax)) (var eax)))) (set _dest (cast 32 false (var _tmp_xp))) (set edx (var _dest)) (branch (== (cast 64 (msb (var _dest)) (var _dest)) (var _tmp_xp)) (seq (set cf false) (set of false)) (seq (set cf true) (set of true)))) +a "imul ecx, 23" 6bc917 0x0 (seq (set _tmp_xp (* (cast 64 (msb (var ecx)) (var ecx)) (cast 64 (msb (bv 32 0x17)) (bv 32 0x17)))) (set _dest (cast 32 false (var _tmp_xp))) (set ecx (var _dest)) (branch (== (cast 64 (msb (var _dest)) (var _dest)) (var _tmp_xp)) (seq (set cf false) (set of false)) (seq (set cf true) (set of true)))) +a "imul edx, ecx, 34" 6bd122 0x0 (seq (set _tmp_xp (* (cast 64 (msb (var ecx)) (var ecx)) (cast 64 (msb (bv 32 0x22)) (bv 32 0x22)))) (set _dest (cast 32 false (var _tmp_xp))) (set edx (var _dest)) (branch (== (cast 64 (msb (var _dest)) (var _dest)) (var _tmp_xp)) (seq (set cf false) (set of false)) (seq (set cf true) (set of true)))) +a "imul byte [eax]" f628 0x0 (seq (set _tmp_xp (* (cast 16 (msb (cast 8 false (var eax))) (cast 8 false (var eax))) (cast 16 (msb (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (loadw 0 8 (+ (var eax) (bv 32 0x0)))))) (set eax (| (& (var eax) (~ (bv 32 0xffff))) (cast 32 false (var _tmp_xp)))) (branch (== (cast 16 (msb (cast 8 false (var _tmp_xp))) (cast 8 false (var _tmp_xp))) (var _tmp_xp)) (seq (set cf false) (set of false)) (seq (set cf true) (set of true)))) +a "imul dword [eax]" f728 0x0 (seq (set _tmp_xp (* (cast 64 (msb (var eax)) (var eax)) (cast 64 (msb (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (loadw 0 32 (+ (var eax) (bv 32 0x0)))))) (set eax (cast 32 false (var _tmp_xp))) (set edx (cast 32 false (>> (var _tmp_xp) (bv 8 0x20) false))) (branch (== (cast 64 (msb (cast 32 false (var _tmp_xp))) (cast 32 false (var _tmp_xp))) (var _tmp_xp)) (seq (set cf false) (set of false)) (seq (set cf true) (set of true)))) +a "imul ebx, [edx + ecx]" 0faf1c0a 0x0 (seq (set _dest (var ebx)) (set _tmp_xp (* (cast 64 (msb (var _dest)) (var _dest)) (cast 64 (msb (loadw 0 32 (+ (+ (var edx) (* (var ecx) (bv 32 0x1))) (bv 32 0x0)))) (loadw 0 32 (+ (+ (var edx) (* (var ecx) (bv 32 0x1))) (bv 32 0x0)))))) (set _dest (cast 32 false (var _tmp_xp))) (set ebx (var _dest)) (branch (== (cast 64 (msb (var _dest)) (var _dest)) (var _tmp_xp)) (seq (set cf false) (set of false)) (seq (set cf true) (set of true)))) +a "imul ebx, dword [edx], 0" 6b1a00 0x0 (seq (set _tmp_xp (* (cast 64 (msb (loadw 0 32 (+ (var edx) (bv 32 0x0)))) (loadw 0 32 (+ (var edx) (bv 32 0x0)))) (cast 64 (msb (bv 32 0x0)) (bv 32 0x0)))) (set _dest (cast 32 false (var _tmp_xp))) (set ebx (var _dest)) (branch (== (cast 64 (msb (var _dest)) (var _dest)) (var _tmp_xp)) (seq (set cf false) (set of false)) (seq (set cf true) (set of true)))) +a "imul ebx, edx, 4" 6bda04 0x0 (seq (set _tmp_xp (* (cast 64 (msb (var edx)) (var edx)) (cast 64 (msb (bv 32 0x4)) (bv 32 0x4)))) (set _dest (cast 32 false (var _tmp_xp))) (set ebx (var _dest)) (branch (== (cast 64 (msb (var _dest)) (var _dest)) (var _tmp_xp)) (seq (set cf false) (set of false)) (seq (set cf true) (set of true)))) +a "imul eax, dword [eax]" 0faf00 0x0 (seq (set _dest (var eax)) (set _tmp_xp (* (cast 64 (msb (var _dest)) (var _dest)) (cast 64 (msb (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (loadw 0 32 (+ (var eax) (bv 32 0x0)))))) (set _dest (cast 32 false (var _tmp_xp))) (set eax (var _dest)) (branch (== (cast 64 (msb (var _dest)) (var _dest)) (var _tmp_xp)) (seq (set cf false) (set of false)) (seq (set cf true) (set of true)))) +a "imul eax, [eax], 0" 6b0000 0x0 (seq (set _tmp_xp (* (cast 64 (msb (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (cast 64 (msb (bv 32 0x0)) (bv 32 0x0)))) (set _dest (cast 32 false (var _tmp_xp))) (set eax (var _dest)) (branch (== (cast 64 (msb (var _dest)) (var _dest)) (var _tmp_xp)) (seq (set cf false) (set of false)) (seq (set cf true) (set of true)))) +a "in al,0" e400 0x0 (seq (goto port) empty) +a "in al,dx" ec 0x0 (seq (goto port) empty) +a "inc byte [eax]" fe00 0x0 (seq (set _op (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set _result (+ (var _op) (bv 8 0x1))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc dword [eax]" ff00 0x0 (seq (set _op (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc eax" 40 0x0 (seq (set _op (var eax)) (set _result (+ (var _op) (bv 32 0x1))) (set eax (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc ebp" 45 0x0 (seq (set _op (var ebp)) (set _result (+ (var _op) (bv 32 0x1))) (set ebp (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc ebx" 43 0x0 (seq (set _op (var ebx)) (set _result (+ (var _op) (bv 32 0x1))) (set ebx (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc ecx" 41 0x0 (seq (set _op (var ecx)) (set _result (+ (var _op) (bv 32 0x1))) (set ecx (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc edi" 47 0x0 (seq (set _op (var edi)) (set _result (+ (var _op) (bv 32 0x1))) (set edi (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc edx" 42 0x0 (seq (set _op (var edx)) (set _result (+ (var _op) (bv 32 0x1))) (set edx (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc esi" 46 0x0 (seq (set _op (var esi)) (set _result (+ (var _op) (bv 32 0x1))) (set esi (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc esp" 44 0x0 (seq (set _op (var esp)) (set _result (+ (var _op) (bv 32 0x1))) (set esp (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "in eax, 0" e500 0x0 (seq (goto port) empty) +a "in eax, 0x8c" e58c 0x0 (seq (goto port) empty) +a "in eax, dx" ed 0x0 (seq (goto port) empty) a "insb byte es:[edi], dx" 6c a "insd dword es:[edi], dx" 6d aB "insertps xmm0, xmm0, 0" 660f3a21c000 -a "int 0x21" cd21 -a "int 1" cd01 +a "int 0x21" cd21 0x0 (seq (goto int) empty) +a "int 1" cd01 0x0 (seq (goto int) empty) a "int1" f1 a "int3" cc -a "int 3" cd03 +a "int 3" cd03 0x0 (seq (goto int) empty) a "into" ce a "invd" 0f08 aB "invlpga" 0f01df aB "invlpg byte [eax]" 0f0138 a "iret" 66cf a "iretd" cf -a "ja 0x8049300" 0f87fa920408 -a "ja 2" 7700 -a "ja 6" 7704 -a "jae 2" 7300 -a "jae 6" 7304 -a "jb 0x8049300" 0f82fa920408 -a "jb 2" 7200 -a "jb 6" 7204 -a "jbe 2" 7600 -a "jbe 6" 7604 -a "je 2" 7400 -a "je 6" 7404 -a "jg 0x8049300" 0f8ffa920408 -a "jg 2" 7f00 -a "jg 6" 7f04 -a "jge 0x8048010" 0f8d0a800408 -a "jge 0x8049300" 0f8dfa920408 -a "jge 2" 7d00 -a "jge 6" 7d04 -a "jl 0x8048010" 0f8c0a800408 -a "jl 0x8049300" 0f8cfa920408 -a "jl 2" 7c00 -a "jl 6" 7c04 -a "jle 0x8048010" 0f8e0a800408 -a "jle 0x8049300" 0f8efa920408 -a "jle 2" 7e00 -a "jle 6" 7e04 -a "jmp 0" ebfe -a "jmp 0x42" eb40 -a "jmp -0x7e" eb80 -a "jmp -0x7f" e97cffffff -a "jmp 0x8049200" e9fb910408 -a "jmp 0x81" eb7f -a "jmp 0x82" e97d000000 -a "jmp 2" eb00 -a "jmp 3" eb01 -a "jmp ecx" ffe1 -a "jmp [ecx]" ff21 -a "jmp [ebx+43]" ff632b -a "jmp [ecx+200]" ffa1c8000000 -a "jmp [edx-10]" ff62f6 -a "jmp [eax-140]" ffa074ffffff +a "ja 0x8049300" 0f87fa920408 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (+ (bv 32 0x0) (bv 32 0x8049300))) nop) +a "ja 2" 7700 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +a "ja 6" 7704 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +a "jae 2" 7300 0x0 (branch (! (var cf)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +a "jae 6" 7304 0x0 (branch (! (var cf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +a "jb 0x8049300" 0f82fa920408 0x0 (branch (var cf) (jmp (+ (bv 32 0x0) (bv 32 0x8049300))) nop) +a "jb 2" 7200 0x0 (branch (var cf) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +a "jb 6" 7204 0x0 (branch (var cf) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +a "jbe 2" 7600 0x0 (branch (|| (var cf) (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +a "jbe 6" 7604 0x0 (branch (|| (var cf) (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +a "je 2" 7400 0x0 (branch (var zf) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +a "je 6" 7404 0x0 (branch (var zf) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +a "jg 0x8049300" 0f8ffa920408 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (+ (bv 32 0x0) (bv 32 0x8049300))) nop) +a "jg 2" 7f00 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +a "jg 6" 7f04 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +a "jge 0x8048010" 0f8d0a800408 0x0 (branch (! (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x8048010))) nop) +a "jge 0x8049300" 0f8dfa920408 0x0 (branch (! (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x8049300))) nop) +a "jge 2" 7d00 0x0 (branch (! (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +a "jge 6" 7d04 0x0 (branch (! (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +a "jl 0x8048010" 0f8c0a800408 0x0 (branch (^^ (var sf) (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x8048010))) nop) +a "jl 0x8049300" 0f8cfa920408 0x0 (branch (^^ (var sf) (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x8049300))) nop) +a "jl 2" 7c00 0x0 (branch (^^ (var sf) (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +a "jl 6" 7c04 0x0 (branch (^^ (var sf) (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +a "jle 0x8048010" 0f8e0a800408 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x8048010))) nop) +a "jle 0x8049300" 0f8efa920408 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x8049300))) nop) +a "jle 2" 7e00 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +a "jle 6" 7e04 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +a "jmp 0" ebfe 0x0 (jmp (+ (bv 32 0x0) (bv 32 0x0))) +a "jmp 0x42" eb40 0x0 (jmp (+ (bv 32 0x0) (bv 32 0x42))) +a "jmp -0x7e" eb80 0x0 (jmp (+ (bv 32 0x0) (bv 32 0xffffff82))) +a "jmp -0x7f" e97cffffff 0x0 (jmp (+ (bv 32 0x0) (bv 32 0xffffff81))) +a "jmp 0x8049200" e9fb910408 0x0 (jmp (+ (bv 32 0x0) (bv 32 0x8049200))) +a "jmp 0x81" eb7f 0x0 (jmp (+ (bv 32 0x0) (bv 32 0x81))) +a "jmp 0x82" e97d000000 0x0 (jmp (+ (bv 32 0x0) (bv 32 0x82))) +a "jmp 2" eb00 0x0 (jmp (+ (bv 32 0x0) (bv 32 0x2))) +a "jmp 3" eb01 0x0 (jmp (+ (bv 32 0x0) (bv 32 0x3))) +a "jmp ecx" ffe1 0x0 (jmp (cast 32 false (var ecx))) +a "jmp [ecx]" ff21 0x0 (jmp (cast 32 false (loadw 0 32 (+ (var ecx) (bv 32 0x0))))) +a "jmp [ebx+43]" ff632b 0x0 (jmp (cast 32 false (loadw 0 32 (+ (var ebx) (bv 32 0x2b))))) +a "jmp [ecx+200]" ffa1c8000000 0x0 (jmp (cast 32 false (loadw 0 32 (+ (var ecx) (bv 32 0xc8))))) +a "jmp [edx-10]" ff62f6 0x0 (jmp (cast 32 false (loadw 0 32 (+ (var edx) (bv 32 0xfffffff6))))) +a "jmp [eax-140]" ffa074ffffff 0x0 (jmp (cast 32 false (loadw 0 32 (+ (var eax) (bv 32 0xffffff74))))) a "bnd jmp 0x82" f2e97d000000 -a "jne 6" 7504 -a "jno 2" 7100 -a "jno 6" 7104 -a "jnp 2" 7b00 -a "jnp 6" 7b04 -a "jns 2" 7900 -a "jns 6" 7904 -a "jnz 2" 7500 -a "jo 2" 7000 -a "jo 6" 7004 -a "jp 2" 7a00 -a "jp 6" 7a04 -a "jpo 599" 0f8b51020000 -a "js 2" 7800 -a "js 6" 7804 -a "jz 6" 7404 -a "jz short 2" 7400 -a "jnz short 6" 7504 -a "jz short 5" 7403 -a "jnz short -2" 75fc -a "jz short -52" 74ca -a "jnz short 23" 7515 -a "jo short 32" 701e -a "jo short -62" 70c0 -a "jno short 52" 7132 -a "jno short -33" 71dd -a "js short 43" 7829 -a "js short -73" 78b5 -a "jns short -41" 79d5 -a "jns short 63" 793d -a "je short 24" 7416 -a "jne SHORT 84" 7552 -a "jb short 23" 7215 -a "jnae short 65" 723f -a "jc SHORT 37" 7223 -a "jnb short 97" 735f -a "jae short 10" 7308 -a "jnc short 0" 73fe -a "jbe short -12" 76f2 -a "jna short 24" 7616 -a "ja short 86" 7754 -a "jnbe short 31" 771d -a "jl short 16" 7c0e -a "jnge short -40" 7cd6 -a "jge short 52" 7d32 -a "jnl short 76" 7d4a -a "jle short 54" 7e34 -a "jng short -80" 7eae -a "jg short 56" 7f36 -a "jnle short 2" 7f00 -a "jp short -7" 7af7 -a "jpe short 22" 7a14 -a "jnp short 64" 7b3e -a "jpo short 88" 7b56 -aB "lahf" 9e +a "jne 6" 7504 0x0 (branch (! (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +a "jno 2" 7100 0x0 (branch (! (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +a "jno 6" 7104 0x0 (branch (! (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +a "jnp 2" 7b00 0x0 (branch (! (var pf)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +a "jnp 6" 7b04 0x0 (branch (! (var pf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +a "jns 2" 7900 0x0 (branch (! (var sf)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +a "jns 6" 7904 0x0 (branch (! (var sf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +a "jnz 2" 7500 0x0 (branch (! (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +a "jo 2" 7000 0x0 (branch (var of) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +a "jo 6" 7004 0x0 (branch (var of) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +a "jp 2" 7a00 0x0 (branch (var pf) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +a "jp 6" 7a04 0x0 (branch (var pf) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +a "jpo 599" 0f8b51020000 0x0 (branch (! (var pf)) (jmp (+ (bv 32 0x0) (bv 32 0x257))) nop) +a "js 2" 7800 0x0 (branch (var sf) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +a "js 6" 7804 0x0 (branch (var sf) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +a "jz 6" 7404 0x0 (branch (var zf) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +a "jz short 2" 7400 0x0 (branch (var zf) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +a "jnz short 6" 7504 0x0 (branch (! (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x6))) nop) +a "jz short 5" 7403 0x0 (branch (var zf) (jmp (+ (bv 32 0x0) (bv 32 0x5))) nop) +a "jnz short -2" 75fc 0x0 (branch (! (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0xfffffffe))) nop) +a "jz short -52" 74ca 0x0 (branch (var zf) (jmp (+ (bv 32 0x0) (bv 32 0xffffffcc))) nop) +a "jnz short 23" 7515 0x0 (branch (! (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x17))) nop) +a "jo short 32" 701e 0x0 (branch (var of) (jmp (+ (bv 32 0x0) (bv 32 0x20))) nop) +a "jo short -62" 70c0 0x0 (branch (var of) (jmp (+ (bv 32 0x0) (bv 32 0xffffffc2))) nop) +a "jno short 52" 7132 0x0 (branch (! (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x34))) nop) +a "jno short -33" 71dd 0x0 (branch (! (var of)) (jmp (+ (bv 32 0x0) (bv 32 0xffffffdf))) nop) +a "js short 43" 7829 0x0 (branch (var sf) (jmp (+ (bv 32 0x0) (bv 32 0x2b))) nop) +a "js short -73" 78b5 0x0 (branch (var sf) (jmp (+ (bv 32 0x0) (bv 32 0xffffffb7))) nop) +a "jns short -41" 79d5 0x0 (branch (! (var sf)) (jmp (+ (bv 32 0x0) (bv 32 0xffffffd7))) nop) +a "jns short 63" 793d 0x0 (branch (! (var sf)) (jmp (+ (bv 32 0x0) (bv 32 0x3f))) nop) +a "je short 24" 7416 0x0 (branch (var zf) (jmp (+ (bv 32 0x0) (bv 32 0x18))) nop) +a "jne SHORT 84" 7552 0x0 (branch (! (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x54))) nop) +a "jb short 23" 7215 0x0 (branch (var cf) (jmp (+ (bv 32 0x0) (bv 32 0x17))) nop) +a "jnae short 65" 723f 0x0 (branch (var cf) (jmp (+ (bv 32 0x0) (bv 32 0x41))) nop) +a "jc SHORT 37" 7223 0x0 (branch (var cf) (jmp (+ (bv 32 0x0) (bv 32 0x25))) nop) +a "jnb short 97" 735f 0x0 (branch (! (var cf)) (jmp (+ (bv 32 0x0) (bv 32 0x61))) nop) +a "jae short 10" 7308 0x0 (branch (! (var cf)) (jmp (+ (bv 32 0x0) (bv 32 0xa))) nop) +a "jnc short 0" 73fe 0x0 (branch (! (var cf)) (jmp (+ (bv 32 0x0) (bv 32 0x0))) nop) +a "jbe short -12" 76f2 0x0 (branch (|| (var cf) (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0xfffffff4))) nop) +a "jna short 24" 7616 0x0 (branch (|| (var cf) (var zf)) (jmp (+ (bv 32 0x0) (bv 32 0x18))) nop) +a "ja short 86" 7754 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (+ (bv 32 0x0) (bv 32 0x56))) nop) +a "jnbe short 31" 771d 0x0 (branch (&& (! (var cf)) (! (var zf))) (jmp (+ (bv 32 0x0) (bv 32 0x1f))) nop) +a "jl short 16" 7c0e 0x0 (branch (^^ (var sf) (var of)) (jmp (+ (bv 32 0x0) (bv 32 0x10))) nop) +a "jnge short -40" 7cd6 0x0 (branch (^^ (var sf) (var of)) (jmp (+ (bv 32 0x0) (bv 32 0xffffffd8))) nop) +a "jge short 52" 7d32 0x0 (branch (! (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x34))) nop) +a "jnl short 76" 7d4a 0x0 (branch (! (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x4c))) nop) +a "jle short 54" 7e34 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0x36))) nop) +a "jng short -80" 7eae 0x0 (branch (|| (var zf) (^^ (var sf) (var of))) (jmp (+ (bv 32 0x0) (bv 32 0xffffffb0))) nop) +a "jg short 56" 7f36 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (+ (bv 32 0x0) (bv 32 0x38))) nop) +a "jnle short 2" 7f00 0x0 (branch (&& (! (var zf)) (! (^^ (var sf) (var of)))) (jmp (+ (bv 32 0x0) (bv 32 0x2))) nop) +a "jp short -7" 7af7 0x0 (branch (var pf) (jmp (+ (bv 32 0x0) (bv 32 0xfffffff9))) nop) +a "jpe short 22" 7a14 0x0 (branch (var pf) (jmp (+ (bv 32 0x0) (bv 32 0x16))) nop) +a "jnp short 64" 7b3e 0x0 (branch (! (var pf)) (jmp (+ (bv 32 0x0) (bv 32 0x40))) nop) +a "jpo short 88" 7b56 0x0 (branch (! (var pf)) (jmp (+ (bv 32 0x0) (bv 32 0x58))) nop) +a "lahf" 9f aB "lar eax, word [eax]" 0f02 aB "lcall 0, 0" 9a aB "lcall [0]" ff1c2500000000 @@ -1359,25 +1376,24 @@ aB "lcall [eax]" ff18 aB "lddqu xmm0, xmmword [eax]" f20ff000 aB "ldmxcsr [eax]" 0fae10 aB "lds eax, [eax]" c500 -a "lea eax, [4]" 8d0504000000 -a "lea eax, [eax+4]" 8d4004 -a "lea eax, [eax]" 8d00 -a "lea eax, [ebp+24]" 8d4518 -a "lea eax, [ebx+24]" 8d4318 -a "lea eax, [ebx+4]" 8d4304 -a "lea eax, [ecx]" 8d01 -a "lea eax, [esp]" 8d0424 -a "lea ebx, [4]" 8d1d04000000 -a "lea ebx, [eax+24]" 8d5818 -a "lea ebx, [eax+4]" 8d5804 -a "lea ebx, [ebp+324]" 8d9d44010000 -a "lea ebx, [ebp]" 8d5d00 -a "lea edx, [0x4422221d]" 8d151d222244 -a "lea edx, 0x2c4b" 8d154b2c0000 -a "leave" c9 -a "les eax, [eax]" c400 -a "les eax, [eax+12]" c4400c -a "les eax, [eax-233]" c48017ffffff +a "lea eax, [4]" 8d0504000000 0x0 (set eax (bv 32 0x4)) +a "lea eax, [eax+4]" 8d4004 0x0 (set eax (+ (var eax) (bv 32 0x4))) +a "lea eax, [eax]" 8d00 0x0 (set eax (+ (var eax) (bv 32 0x0))) +a "lea eax, [ebp+24]" 8d4518 0x0 (set eax (+ (var ebp) (bv 32 0x18))) +a "lea eax, [ebx+24]" 8d4318 0x0 (set eax (+ (var ebx) (bv 32 0x18))) +a "lea eax, [ebx+4]" 8d4304 0x0 (set eax (+ (var ebx) (bv 32 0x4))) +a "lea eax, [ecx]" 8d01 0x0 (set eax (+ (var ecx) (bv 32 0x0))) +a "lea eax, [esp]" 8d0424 0x0 (set eax (+ (var esp) (bv 32 0x0))) +a "lea ebx, [4]" 8d1d04000000 0x0 (set ebx (bv 32 0x4)) +a "lea ebx, [eax+24]" 8d5818 0x0 (set ebx (+ (var eax) (bv 32 0x18))) +a "lea ebx, [eax+4]" 8d5804 0x0 (set ebx (+ (var eax) (bv 32 0x4))) +a "lea ebx, [ebp+324]" 8d9d44010000 0x0 (set ebx (+ (var ebp) (bv 32 0x144))) +a "lea ebx, [ebp]" 8d5d00 0x0 (set ebx (+ (var ebp) (bv 32 0x0))) +a "lea edx, [0x4422221d]" 8d151d222244 0x0 (set edx (bv 32 0x4422221d)) +a "lea edx, 0x2c4b" 8d154b2c0000 0x0 (set edx (bv 32 0x2c4b)) +a "les eax, [eax]" c400 0x0 (set eax (+ (+ (var eax) (bv 32 0x0)) (<< (cast 32 false (var es)) (bv 8 0x4) false))) +a "les eax, [eax+12]" c4400c 0x0 (set eax (+ (+ (var eax) (bv 32 0xc)) (<< (cast 32 false (var es)) (bv 8 0x4) false))) +a "les eax, [eax-233]" c48017ffffff 0x0 (set eax (+ (+ (var eax) (bv 32 0xffffff17)) (<< (cast 32 false (var es)) (bv 8 0x4) false))) a "lfence" 0faee8 aB "lfs eax, dword [eax]" 0fb400 a "lgdt [eax]" 0f0110 @@ -1411,147 +1427,147 @@ aB "minps xmm0, xmmword [eax]" 0f5d00 aB "minsd xmm0, qword [eax]" f20f5d00 aB "minss xmm0, dword [eax]" f30f5d00 a "monitor" 0f01c8 -a "mov [33], ebp" 892d21000000 -a "mov [33], ebx" 891d21000000 -a "mov [33], ecx" 890d21000000 -a "mov [33], edi" 893d21000000 -a "mov [33], edx" 891521000000 -a "mov [33], esi" 893521000000 -a "mov [33], esp" 892521000000 -a "mov ah, 0" b400 -a "mov al, 0" b000 -a "mov al, byte [0]" a000000000 -a "mov al, byte [eax]" 8a00 -a "mov al, [eax]" 8a00 +a "mov [33], ebp" 892d21000000 0x0 (storew 0 (bv 32 0x21) (var ebp)) +a "mov [33], ebx" 891d21000000 0x0 (storew 0 (bv 32 0x21) (var ebx)) +a "mov [33], ecx" 890d21000000 0x0 (storew 0 (bv 32 0x21) (var ecx)) +a "mov [33], edi" 893d21000000 0x0 (storew 0 (bv 32 0x21) (var edi)) +a "mov [33], edx" 891521000000 0x0 (storew 0 (bv 32 0x21) (var edx)) +a "mov [33], esi" 893521000000 0x0 (storew 0 (bv 32 0x21) (var esi)) +a "mov [33], esp" 892521000000 0x0 (storew 0 (bv 32 0x21) (var esp)) +a "mov ah, 0" b400 0x0 (set eax (| (& (var eax) (~ (bv 32 0xff00))) (<< (cast 32 false (bv 8 0x0)) (bv 8 0x8) false))) +a "mov al, 0" b000 0x0 (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (bv 8 0x0)))) +a "mov al, byte [0]" a000000000 0x0 (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (loadw 0 8 (bv 32 0x0))))) +a "mov al, byte [eax]" 8a00 0x0 (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (loadw 0 8 (+ (var eax) (bv 32 0x0)))))) +a "mov al, [eax]" 8a00 0x0 (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (loadw 0 8 (+ (var eax) (bv 32 0x0)))))) aB "movapd xmm0, xmmword [eax]" 660f2800 aB "movapd xmmword [eax], xmm0" 660f2900 aB "movaps xmm0, xmmword [eax]" 0f2800 aB "movaps xmmword [eax], xmm0" 0f2900 aB "movbe dword [eax], eax" 0f38f100 aB "movbe eax, dword [eax]" 0f38f000 -a "mov bh, 0" b700 -a "mov bl, 0" b300 -a "mov byte [0], al" 880500000000 -a "mov ch, 0" b500 -a "mov cl, 0" b100 -a "mov cr0, eax" 0f22c0 +a "mov bh, 0" b700 0x0 (set ebx (| (& (var ebx) (~ (bv 32 0xff00))) (<< (cast 32 false (bv 8 0x0)) (bv 8 0x8) false))) +a "mov bl, 0" b300 0x0 (set ebx (| (& (var ebx) (~ (bv 32 0xff))) (cast 32 false (bv 8 0x0)))) +a "mov byte [0], al" 880500000000 0x0 (storew 0 (bv 32 0x0) (cast 8 false (var eax))) +a "mov ch, 0" b500 0x0 (set ecx (| (& (var ecx) (~ (bv 32 0xff00))) (<< (cast 32 false (bv 8 0x0)) (bv 8 0x8) false))) +a "mov cl, 0" b100 0x0 (set ecx (| (& (var ecx) (~ (bv 32 0xff))) (cast 32 false (bv 8 0x0)))) +a "mov cr0, eax" 0f22c0 0x0 (set cr0 (var eax)) aB "movddup xmm0, qword [eax]" f20f1200 aB "movd dword [eax], mm0" 0f7e00 aB "movd dword [eax], xmm0" 660f7e00 -a "mov dh, 0" b600 -a "mov dl, 0" b200 +a "mov dh, 0" b600 0x0 (set edx (| (& (var edx) (~ (bv 32 0xff00))) (<< (cast 32 false (bv 8 0x0)) (bv 8 0x8) false))) +a "mov dl, 0" b200 0x0 (set edx (| (& (var edx) (~ (bv 32 0xff))) (cast 32 false (bv 8 0x0)))) aB "movd mm0, dword [eax]" 0f6e00 aB "movdq2q mm0, xmm0" f20fd6 aB "movdqa xmm0, xmmword [eax]" 660f6f00 aB "movdqa xmmword [eax], xmm0" 660f7f00 aB "movdqu xmm0, xmmword [eax]" f30f6f00 aB "movdqu xmmword [eax], xmm0" f30f7f00 -a "mov dr0, eax" 0f23c0 -a "mov dword [0], eax" 890500000000 +a "mov dr0, eax" 0f23c0 0x0 (set dr0 (var eax)) +a "mov dword [0], eax" 890500000000 0x0 (storew 0 (bv 32 0x0) (var eax)) aB "mov dword cs:[eax], eax" 2e8900 aB "mov dword ds:[eax], eax" 3e8900 -a "mov dword [eax], 0" c70000000000 -a "mov dword [eax], 0x6f77206f" c7006f20776f -a "mov dword [eax+16], 0x6f77206f" c740106f20776f -a "mov dword [eax], 3" c70003000000 -a "mov dword [eax+4], 1" c7400401000000 -a "mov dword [eax+4], 3" c7400403000000 -a "mov dword [eax+450], 0x6f77206f" c780c20100006f20776f -a "mov dword [eax+4], 666" c740049a020000 -a "mov dword [eax-512], 421" c78000feffffa5010000 -a "mov dword [eax], 666" c7009a020000 -a "mov dword [eax], eax" 8900 -a "mov dword [ebp-12], 1" c745f401000000 -a "mov dword [ebp+16], 0x6f77206f" c745106f20776f -a "mov dword [ebp-312], 3" c785c8feffff03000000 -a "mov dword [ebp+4], 1" c7450401000000 -a "mov dword [ebp+450], 0x6f77206f" c785c20100006f20776f +a "mov dword [eax], 0" c70000000000 0x0 (storew 0 (+ (var eax) (bv 32 0x0)) (bv 32 0x0)) +a "mov dword [eax], 0x6f77206f" c7006f20776f 0x0 (storew 0 (+ (var eax) (bv 32 0x0)) (bv 32 0x6f77206f)) +a "mov dword [eax+16], 0x6f77206f" c740106f20776f 0x0 (storew 0 (+ (var eax) (bv 32 0x10)) (bv 32 0x6f77206f)) +a "mov dword [eax], 3" c70003000000 0x0 (storew 0 (+ (var eax) (bv 32 0x0)) (bv 32 0x3)) +a "mov dword [eax+4], 1" c7400401000000 0x0 (storew 0 (+ (var eax) (bv 32 0x4)) (bv 32 0x1)) +a "mov dword [eax+4], 3" c7400403000000 0x0 (storew 0 (+ (var eax) (bv 32 0x4)) (bv 32 0x3)) +a "mov dword [eax+450], 0x6f77206f" c780c20100006f20776f 0x0 (storew 0 (+ (var eax) (bv 32 0x1c2)) (bv 32 0x6f77206f)) +a "mov dword [eax+4], 666" c740049a020000 0x0 (storew 0 (+ (var eax) (bv 32 0x4)) (bv 32 0x29a)) +a "mov dword [eax-512], 421" c78000feffffa5010000 0x0 (storew 0 (+ (var eax) (bv 32 0xfffffe00)) (bv 32 0x1a5)) +a "mov dword [eax], 666" c7009a020000 0x0 (storew 0 (+ (var eax) (bv 32 0x0)) (bv 32 0x29a)) +a "mov dword [eax], eax" 8900 0x0 (storew 0 (+ (var eax) (bv 32 0x0)) (var eax)) +a "mov dword [ebp-12], 1" c745f401000000 0x0 (storew 0 (+ (var ebp) (bv 32 0xfffffff4)) (bv 32 0x1)) +a "mov dword [ebp+16], 0x6f77206f" c745106f20776f 0x0 (storew 0 (+ (var ebp) (bv 32 0x10)) (bv 32 0x6f77206f)) +a "mov dword [ebp-312], 3" c785c8feffff03000000 0x0 (storew 0 (+ (var ebp) (bv 32 0xfffffec8)) (bv 32 0x3)) +a "mov dword [ebp+4], 1" c7450401000000 0x0 (storew 0 (+ (var ebp) (bv 32 0x4)) (bv 32 0x1)) +a "mov dword [ebp+450], 0x6f77206f" c785c20100006f20776f 0x0 (storew 0 (+ (var ebp) (bv 32 0x1c2)) (bv 32 0x6f77206f)) aB "mov dword es:[eax], eax" 268900 -a "mov dword [esi+4], 33" c7460421000000 -a "mov dword [esp-312], 321" c78424c8feffff41010000 -a "mov dword [esp], 3" c7042403000000 -a "mov dword [esp+4], 1" c744240401000000 +a "mov dword [esi+4], 33" c7460421000000 0x0 (storew 0 (+ (var esi) (bv 32 0x4)) (bv 32 0x21)) +a "mov dword [esp-312], 321" c78424c8feffff41010000 0x0 (storew 0 (+ (var esp) (bv 32 0xfffffec8)) (bv 32 0x141)) +a "mov dword [esp], 3" c7042403000000 0x0 (storew 0 (+ (var esp) (bv 32 0x0)) (bv 32 0x3)) +a "mov dword [esp+4], 1" c744240401000000 0x0 (storew 0 (+ (var esp) (bv 32 0x4)) (bv 32 0x1)) aB "mov dword fs:[eax], eax" 648900 aB "mov dword gs:[eax], eax" 658900 aB "mov dword ss:[eax], eax" 368900 aB "mov eax, dword fs:[1]" 648b042501000000 aB "movd xmm0, dword [eax]" 660f6e00 -a "mov eax, 0" b800000000 -a "mov [eax], 0" c70000000000 -a "mov eax, 0x8049000" b800900408 -a "mov eax, 1" b801000000 -a "mov [eax+2], ebx" 895802 -a "mov [eax+345], ebx" 899859010000 -a "mov eax, 300" b82c010000 -a "mov eax, 3" b803000000 -a "mov [eax+4], eax" 894004 -a "mov [eax+4], ecx" 894804 -a "mov eax, cr0" 0f20c0 -a "mov eax, dr0" 0f21c0 -a "mov eax, dword [0]" a100000000 -a "mov ecx, dword [0]" 8b0d00000000 -a "mov ecx, dword [1]" 8b0d01000000 -a "mov eax, dword [eax]" 8b00 -a "mov eax, dword [ebp]" 8b4500 -a "mov eax, dword [esp]" 8b0424 +a "mov eax, 0" b800000000 0x0 (set eax (bv 32 0x0)) +a "mov [eax], 0" c70000000000 0x0 (storew 0 (+ (var eax) (bv 32 0x0)) (bv 32 0x0)) +a "mov eax, 0x8049000" b800900408 0x0 (set eax (bv 32 0x8049000)) +a "mov eax, 1" b801000000 0x0 (set eax (bv 32 0x1)) +a "mov [eax+2], ebx" 895802 0x0 (storew 0 (+ (var eax) (bv 32 0x2)) (var ebx)) +a "mov [eax+345], ebx" 899859010000 0x0 (storew 0 (+ (var eax) (bv 32 0x159)) (var ebx)) +a "mov eax, 300" b82c010000 0x0 (set eax (bv 32 0x12c)) +a "mov eax, 3" b803000000 0x0 (set eax (bv 32 0x3)) +a "mov [eax+4], eax" 894004 0x0 (storew 0 (+ (var eax) (bv 32 0x4)) (var eax)) +a "mov [eax+4], ecx" 894804 0x0 (storew 0 (+ (var eax) (bv 32 0x4)) (var ecx)) +a "mov eax, cr0" 0f20c0 0x0 (set eax (var cr0)) +a "mov eax, dr0" 0f21c0 0x0 (set eax (var dr0)) +a "mov eax, dword [0]" a100000000 0x0 (set eax (loadw 0 32 (bv 32 0x0))) +a "mov ecx, dword [0]" 8b0d00000000 0x0 (set ecx (loadw 0 32 (bv 32 0x0))) +a "mov ecx, dword [1]" 8b0d01000000 0x0 (set ecx (loadw 0 32 (bv 32 0x1))) +a "mov eax, dword [eax]" 8b00 0x0 (set eax (loadw 0 32 (+ (var eax) (bv 32 0x0)))) +a "mov eax, dword [ebp]" 8b4500 0x0 (set eax (loadw 0 32 (+ (var ebp) (bv 32 0x0)))) +a "mov eax, dword [esp]" 8b0424 0x0 (set eax (loadw 0 32 (+ (var esp) (bv 32 0x0)))) aB "mov eax, dword fs:[ebp]" 648b4500 -a "mov eax, [eax+1337]" 8b8039050000 -a "mov ecx, [eip+1337]" 8b0d39050000 -a "mov ecx, [eip+13]" 8b0d0d000000 -a "mov eax, [eax-1337]" 8b80c7faffff -a "mov eax,[eax*4+32]" 8b048520000000 -a "mov eax,[eax*4-32]" 8b0485e0ffffff -a "mov eax,[eax*4+332]" 8b04854c010000 -a "mov eax,[eax*4-332]" 8b0485b4feffff -a "mov eax, [eax+4]" 8b4004 -a "mov eax, [eax-4]" 8b40fc -a "mov [eax], eax" 8900 -a "mov byte [eax], al" 8800 -a "mov eax, eax" 89c0 -a "mov eax, [eax]" 8b00 -a "mov [eax+eax], eax" 890400 +a "mov eax, [eax+1337]" 8b8039050000 0x0 (set eax (loadw 0 32 (+ (var eax) (bv 32 0x539)))) +a "mov ecx, [eip+1337]" 8b0d39050000 0x0 (set ecx (loadw 0 32 (bv 32 0x539))) +a "mov ecx, [eip+13]" 8b0d0d000000 0x0 (set ecx (loadw 0 32 (bv 32 0xd))) +a "mov eax, [eax-1337]" 8b80c7faffff 0x0 (set eax (loadw 0 32 (+ (var eax) (bv 32 0xfffffac7)))) +a "mov eax,[eax*4+32]" 8b048520000000 0x0 (set eax (loadw 0 32 (+ (* (var eax) (bv 32 0x4)) (bv 32 0x20)))) +a "mov eax,[eax*4-32]" 8b0485e0ffffff 0x0 (set eax (loadw 0 32 (+ (* (var eax) (bv 32 0x4)) (bv 32 0xffffffe0)))) +a "mov eax,[eax*4+332]" 8b04854c010000 0x0 (set eax (loadw 0 32 (+ (* (var eax) (bv 32 0x4)) (bv 32 0x14c)))) +a "mov eax,[eax*4-332]" 8b0485b4feffff 0x0 (set eax (loadw 0 32 (+ (* (var eax) (bv 32 0x4)) (bv 32 0xfffffeb4)))) +a "mov eax, [eax+4]" 8b4004 0x0 (set eax (loadw 0 32 (+ (var eax) (bv 32 0x4)))) +a "mov eax, [eax-4]" 8b40fc 0x0 (set eax (loadw 0 32 (+ (var eax) (bv 32 0xfffffffc)))) +a "mov [eax], eax" 8900 0x0 (storew 0 (+ (var eax) (bv 32 0x0)) (var eax)) +a "mov byte [eax], al" 8800 0x0 (storew 0 (+ (var eax) (bv 32 0x0)) (cast 8 false (var eax))) +a "mov eax, eax" 89c0 0x0 (set eax (var eax)) +a "mov eax, [eax]" 8b00 0x0 (set eax (loadw 0 32 (+ (var eax) (bv 32 0x0)))) +a "mov [eax+eax], eax" 890400 0x0 (storew 0 (+ (+ (var eax) (* (var eax) (bv 32 0x1))) (bv 32 0x0)) (var eax)) aB "mov eax,[eax+ebx*4+32]" 8b449820 -a "mov [eax+eax], ebx" 891c00 -a "mov [eax+eax], ecx" 890c00 -a "mov eax, [ebp]" 8b4500 -a "mov [eax], ebx" 8918 -a "mov eax, ebx" 89d8 -a "mov eax, [ebx]" 8b03 -a "mov eax,[ecx*8+64]" 8b04cd40000000 +a "mov [eax+eax], ebx" 891c00 0x0 (storew 0 (+ (+ (var eax) (* (var eax) (bv 32 0x1))) (bv 32 0x0)) (var ebx)) +a "mov [eax+eax], ecx" 890c00 0x0 (storew 0 (+ (+ (var eax) (* (var eax) (bv 32 0x1))) (bv 32 0x0)) (var ecx)) +a "mov eax, [ebp]" 8b4500 0x0 (set eax (loadw 0 32 (+ (var ebp) (bv 32 0x0)))) +a "mov [eax], ebx" 8918 0x0 (storew 0 (+ (var eax) (bv 32 0x0)) (var ebx)) +a "mov eax, ebx" 89d8 0x0 (set eax (var ebx)) +a "mov eax, [ebx]" 8b03 0x0 (set eax (loadw 0 32 (+ (var ebx) (bv 32 0x0)))) +a "mov eax,[ecx*8+64]" 8b04cd40000000 0x0 (set eax (loadw 0 32 (+ (* (var ecx) (bv 32 0x8)) (bv 32 0x40)))) aB "mov [ecx*8+64], eax" 8904CD40000000 -a "mov [eax+ecx], eax" 890408 -a "mov eax, [esi]" 8b06 -a "mov eax, [esp+4]" 8b442404 -a "mov eax, esp" 89e0 -a "mov eax, [esp]" 8b0424 -a "mov ebp, 0" bd00000000 -a "mov [ebp+4], eax" 898504000000 -a "mov [ebp+4], ebx" 899d04000000 -a "mov [ebp+4], ecx" 898d04000000 -a "mov ebx, 0" bb00000000 -a "mov [ebx+2], ebx" 895b02 -a "mov [ebx-2], ecx" 894bfe -a "mov ebx, -3" bbfdffffff -a "mov [ebx+454], ebx" 899bc6010000 -a "mov [ebx-552], edx" 8993d8fdffff -a "mov [ebx], eax" 8903 -a "mov ebx, eax" 89c3 -a "mov ebx, [eax]" 8b18 -a "mov [ebx+eax], eax" 890403 -a "mov ebx, [ecx + edx]" 8b1c11 -a "mov ecx, 0" b900000000 -a "mov ecx, -432" b950feffff -a "mov ecx, [eax]" 8b08 -a "mov edi, 0" bf00000000 -a "mov edx, 0" ba00000000 -a "mov esi, 0" be00000000 -a "mov esi, [esi + 8]" 8b7608 -a "mov esp, 0" bc00000000 -a "mov [esp-12], eax" 894424f4 -a "mov [esp+2], ebx" 895c2402 -a "mov [esp-2], ebx" 895c24fe -a "mov [esp-233], ebx" 899c2417ffffff -a "mov [esp+454], ebx" 899c24c6010000 +a "mov [eax+ecx], eax" 890408 0x0 (storew 0 (+ (+ (var eax) (* (var ecx) (bv 32 0x1))) (bv 32 0x0)) (var eax)) +a "mov eax, [esi]" 8b06 0x0 (set eax (loadw 0 32 (+ (var esi) (bv 32 0x0)))) +a "mov eax, [esp+4]" 8b442404 0x0 (set eax (loadw 0 32 (+ (var esp) (bv 32 0x4)))) +a "mov eax, esp" 89e0 0x0 (set eax (var esp)) +a "mov eax, [esp]" 8b0424 0x0 (set eax (loadw 0 32 (+ (var esp) (bv 32 0x0)))) +a "mov ebp, 0" bd00000000 0x0 (set ebp (bv 32 0x0)) +a "mov [ebp+4], eax" 898504000000 0x0 (storew 0 (+ (var ebp) (bv 32 0x4)) (var eax)) +a "mov [ebp+4], ebx" 899d04000000 0x0 (storew 0 (+ (var ebp) (bv 32 0x4)) (var ebx)) +a "mov [ebp+4], ecx" 898d04000000 0x0 (storew 0 (+ (var ebp) (bv 32 0x4)) (var ecx)) +a "mov ebx, 0" bb00000000 0x0 (set ebx (bv 32 0x0)) +a "mov [ebx+2], ebx" 895b02 0x0 (storew 0 (+ (var ebx) (bv 32 0x2)) (var ebx)) +a "mov [ebx-2], ecx" 894bfe 0x0 (storew 0 (+ (var ebx) (bv 32 0xfffffffe)) (var ecx)) +a "mov ebx, -3" bbfdffffff 0x0 (set ebx (bv 32 0xfffffffd)) +a "mov [ebx+454], ebx" 899bc6010000 0x0 (storew 0 (+ (var ebx) (bv 32 0x1c6)) (var ebx)) +a "mov [ebx-552], edx" 8993d8fdffff 0x0 (storew 0 (+ (var ebx) (bv 32 0xfffffdd8)) (var edx)) +a "mov [ebx], eax" 8903 0x0 (storew 0 (+ (var ebx) (bv 32 0x0)) (var eax)) +a "mov ebx, eax" 89c3 0x0 (set ebx (var eax)) +a "mov ebx, [eax]" 8b18 0x0 (set ebx (loadw 0 32 (+ (var eax) (bv 32 0x0)))) +a "mov [ebx+eax], eax" 890403 0x0 (storew 0 (+ (+ (var ebx) (* (var eax) (bv 32 0x1))) (bv 32 0x0)) (var eax)) +a "mov ebx, [ecx + edx]" 8b1c11 0x0 (set ebx (loadw 0 32 (+ (+ (var ecx) (* (var edx) (bv 32 0x1))) (bv 32 0x0)))) +a "mov ecx, 0" b900000000 0x0 (set ecx (bv 32 0x0)) +a "mov ecx, -432" b950feffff 0x0 (set ecx (bv 32 0xfffffe50)) +a "mov ecx, [eax]" 8b08 0x0 (set ecx (loadw 0 32 (+ (var eax) (bv 32 0x0)))) +a "mov edi, 0" bf00000000 0x0 (set edi (bv 32 0x0)) +a "mov edx, 0" ba00000000 0x0 (set edx (bv 32 0x0)) +a "mov esi, 0" be00000000 0x0 (set esi (bv 32 0x0)) +a "mov esi, [esi + 8]" 8b7608 0x0 (set esi (loadw 0 32 (+ (var esi) (bv 32 0x8)))) +a "mov esp, 0" bc00000000 0x0 (set esp (bv 32 0x0)) +a "mov [esp-12], eax" 894424f4 0x0 (storew 0 (+ (var esp) (bv 32 0xfffffff4)) (var eax)) +a "mov [esp+2], ebx" 895c2402 0x0 (storew 0 (+ (var esp) (bv 32 0x2)) (var ebx)) +a "mov [esp-2], ebx" 895c24fe 0x0 (storew 0 (+ (var esp) (bv 32 0xfffffffe)) (var ebx)) +a "mov [esp-233], ebx" 899c2417ffffff 0x0 (storew 0 (+ (var esp) (bv 32 0xffffff17)) (var ebx)) +a "mov [esp+454], ebx" 899c24c6010000 0x0 (storew 0 (+ (var esp) (bv 32 0x1c6)) (var ebx)) aB "mov es, word [eax]" 8e00 aB "movhlps xmm0, xmm0" 0f12 aB "movhpd qword [eax], xmm0" 660f1700 @@ -1576,8 +1592,9 @@ aB "movq mm0, qword [eax]" 0f6f00 aB "movq qword [eax], mm0" 0f7f00 aB "movq qword [eax], xmm0" 660fd600 aB "movq xmm0, qword [eax]" f30f7e00 -a "movsb byte es:[edi], byte ptr [esi]" a4 -a "movsd dword es:[edi], dword ptr [esi]" a5 +a "movsb byte es:[edi], byte ptr [esi]" a4 0x0 (seq (storew 0 (+ (+ (var edi) (bv 32 0x0)) (<< (cast 32 false (var es)) (bv 8 0x4) false)) (loadw 0 8 (+ (+ (var esi) (bv 32 0x0)) (<< (cast 32 false (var ds)) (bv 8 0x4) false)))) (branch (var df) (seq (set esi (- (var esi) (bv 32 0x1))) (set edi (- (var edi) (bv 32 0x1)))) (seq (set esi (+ (var esi) (bv 32 0x1))) (set edi (+ (var edi) (bv 32 0x1)))))) +a "movsd dword es:[edi], dword ptr [esi]" a5 0x0 (seq (storew 0 (+ (+ (var edi) (bv 32 0x0)) (<< (cast 32 false (var es)) (bv 8 0x4) false)) (loadw 0 32 (+ (+ (var esi) (bv 32 0x0)) (<< (cast 32 false (var ds)) (bv 8 0x4) false)))) (branch (var df) (seq (set esi (- (var esi) (bv 32 0x4))) (set edi (- (var edi) (bv 32 0x4)))) (seq (set esi (+ (var esi) (bv 32 0x4))) (set edi (+ (var edi) (bv 32 0x4)))))) +d "movsd dword es:[di], dword ptr [si]" 67a5 0x0 (seq (storew 0 (+ (+ (cast 32 false (cast 16 false (var edi))) (bv 32 0x0)) (<< (cast 32 false (var es)) (bv 8 0x4) false)) (loadw 0 32 (+ (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x0)) (<< (cast 32 false (var ds)) (bv 8 0x4) false)))) (branch (var df) (seq (set esi (| (& (var esi) (~ (bv 32 0xffff))) (cast 32 false (- (cast 16 false (var esi)) (bv 16 0x4))))) (set edi (| (& (var edi) (~ (bv 32 0xffff))) (cast 32 false (- (cast 16 false (var edi)) (bv 16 0x4)))))) (seq (set esi (| (& (var esi) (~ (bv 32 0xffff))) (cast 32 false (+ (cast 16 false (var esi)) (bv 16 0x4))))) (set edi (| (& (var edi) (~ (bv 32 0xffff))) (cast 32 false (+ (cast 16 false (var edi)) (bv 16 0x4)))))))) aB "movsd dword es:[edi], dword ptr fs:[esi]" 64a5 aB "movsd qword [eax], xmm0" f20f1100 aB "movsd xmm0, qword [eax]" f20f1000 @@ -1591,13 +1608,15 @@ aB "movupd xmm0, xmmword [eax]" 660f1000 aB "movupd xmmword [eax], xmm0" 660f1100 aB "movups xmm0, xmmword [eax]" 0f10 aB "movups xmmword [eax], xmm0" 0f11 -a "mov word [eax], es" 8c00 +a "mov word [eax], es" 8c00 0x0 (storew 0 (+ (var eax) (bv 32 0x0)) (var es)) a "movzx eax, byte [eax]" 0fb600 a "movzx ecx, byte [esp]" 0fb60c24 a "movzx eax, word [eax]" 0fb700 a "movzx edx, word [esp]" 0fb71424 aB "mpsadbw xmm0, xmm0, 0" 660f3a42c000 -a "mul byte [eax]" f620 +ad "mul byte [eax]" f620 0x0 (seq (set _mul (* (cast 16 false (cast 8 false (var eax))) (cast 16 false (loadw 0 8 (+ (var eax) (bv 32 0x0)))))) (set eax (| (& (var eax) (~ (bv 32 0xffff))) (cast 32 false (var _mul)))) (branch (is_zero (>> (var _mul) (bv 8 0x8) false)) (seq (set of false) (set cf false)) (seq (set of true) (set cf true)))) +ad "mul word [eax]" 66f720 0x0 (seq (set _mul (* (cast 32 false (cast 16 false (var eax))) (cast 32 false (loadw 0 16 (+ (var eax) (bv 32 0x0)))))) (set edx (| (& (var edx) (~ (bv 32 0xffff))) (cast 32 false (cast 16 false (>> (var _mul) (bv 8 0x10) false))))) (set eax (| (& (var eax) (~ (bv 32 0xffff))) (cast 32 false (cast 16 false (var _mul))))) (branch (is_zero (>> (var _mul) (bv 8 0x10) false)) (seq (set of false) (set cf false)) (seq (set of true) (set cf true)))) +ad "mul dword [eax]" f720 0x0 (seq (set _mul (* (cast 64 false (var eax)) (cast 64 false (loadw 0 32 (+ (var eax) (bv 32 0x0)))))) (set edx (cast 32 false (>> (var _mul) (bv 8 0x20) false))) (set eax (cast 32 false (var _mul))) (branch (is_zero (>> (var _mul) (bv 8 0x20) false)) (seq (set of false) (set cf false)) (seq (set of true) (set cf true)))) aB "mulpd xmm0, xmmword [eax]" 660f5900 aB "mulpd xmm7, xmm7" 660f59ff aB "mulps xmm0, xmmword [eax]" 0f5900 @@ -1609,18 +1628,17 @@ aB "mulss xmm0, dword [eax]" f30f5900 aB "mulss xmm7, xmm7" 66f2f0f59ff0 a "mwait" 0f01c9 aB "neg byte [eax]" f618 -a "nop" 90 aB "not byte [eax]" f610 aB "not al" f6d0 -a "or al, 0" 0c00 -a "or byte [eax], al" 0800 -a "or dword [eax], eax" 0900 -a "or eax, dword [eax]" 0b00 +a "or al, 0" 0c00 0x0 (seq (set _or (| (cast 8 false (var eax)) (bv 8 0x0))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _or)))) (set of false) (set cf false) (set _result (var _or)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "or byte [eax], al" 0800 0x0 (seq (set _or (| (loadw 0 8 (+ (var eax) (bv 32 0x0))) (cast 8 false (var eax)))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _or)) (set of false) (set cf false) (set _result (var _or)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "or dword [eax], eax" 0900 0x0 (seq (set _or (| (loadw 0 32 (+ (var eax) (bv 32 0x0))) (var eax))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _or)) (set of false) (set cf false) (set _result (var _or)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "or eax, dword [eax]" 0b00 0x0 (seq (set _or (| (var eax) (loadw 0 32 (+ (var eax) (bv 32 0x0))))) (set eax (var _or)) (set of false) (set cf false) (set _result (var _or)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) aB "orpd xmm0, xmmword [eax]" 660f5600 aB "orps xmm0, xmmword [eax]" 0f5600 -a "out 0, al" e600 -a "out 0, eax" e700 -a "out 0x84, eax" e784 +a "out 0, al" e600 0x0 (seq (goto port) empty) +a "out 0, eax" e700 0x0 (seq (goto port) empty) +a "out 0x84, eax" e784 0x0 (seq (goto port) empty) a "outsb dx, byte [esi]" 6e a "outsd dx, dword [esi]" 6f aB "pabsb xmm0, xmm0" 660f381cc0 @@ -1744,28 +1762,28 @@ aB "pmuludq xmm0, xmmword [eax]" 660ff400 a "popal" 61 a "popaw" 6661 aB "popcnt eax, qword [eax]" f30fb8 -a "pop ds" 1f -a "pop dword [eax+4]" 8f4004 -a "pop dword [eax]" 8f00 -a "pop dword [ebp+4]" 8f4504 -a "pop dword [ebp]" 8f4500 -a "pop dword [ecx]" 8f01 -a "pop dword [edi]" 8f07 -a "pop dword [esi]" 8f06 -a "pop dword [esp]" 8f0424 -a "pop eax" 58 -a "pop ebp" 5d -a "pop ebx" 5b -a "pop ecx" 59 -a "pop edi" 5f -a "pop edx" 5a -a "pop es" 07 -a "pop esi" 5e -a "pop esp" 5c -a "popfd" 9d -a "pop fs" 0fa1 -a "pop gs" 0fa9 -a "pop ss" 17 +a "pop ds" 1f 0x0 (seq (set ds (loadw 0 16 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x2)))) +a "pop dword [eax+4]" 8f4004 0x0 (seq (storew 0 (+ (var eax) (bv 32 0x4)) (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +a "pop dword [eax]" 8f00 0x0 (seq (storew 0 (+ (var eax) (bv 32 0x0)) (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +a "pop dword [ebp+4]" 8f4504 0x0 (seq (storew 0 (+ (var ebp) (bv 32 0x4)) (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +a "pop dword [ebp]" 8f4500 0x0 (seq (storew 0 (+ (var ebp) (bv 32 0x0)) (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +a "pop dword [ecx]" 8f01 0x0 (seq (storew 0 (+ (var ecx) (bv 32 0x0)) (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +a "pop dword [edi]" 8f07 0x0 (seq (storew 0 (+ (var edi) (bv 32 0x0)) (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +a "pop dword [esi]" 8f06 0x0 (seq (storew 0 (+ (var esi) (bv 32 0x0)) (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +a "pop dword [esp]" 8f0424 0x0 (seq (storew 0 (+ (var esp) (bv 32 0x0)) (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +a "pop eax" 58 0x0 (seq (set eax (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +a "pop ebp" 5d 0x0 (seq (set ebp (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +a "pop ebx" 5b 0x0 (seq (set ebx (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +a "pop ecx" 59 0x0 (seq (set ecx (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +a "pop edi" 5f 0x0 (seq (set edi (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +a "pop edx" 5a 0x0 (seq (set edx (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +a "pop es" 07 0x0 (seq (set es (loadw 0 16 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x2)))) +a "pop esi" 5e 0x0 (seq (set esi (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +a "pop esp" 5c 0x0 (seq (set esp (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x4)))) +a "popfd" 9d 0x0 (seq (set _flags (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set cf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set pf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set af (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set zf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set sf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set tf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set if (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set df (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set of (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x3) false)) (set nt (lsb (var _flags))) (set esp (+ (var esp) (bv 32 0x4)))) +a "pop fs" 0fa1 0x0 (seq (set fs (loadw 0 16 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x2)))) +a "pop gs" 0fa9 0x0 (seq (set gs (loadw 0 16 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x2)))) +a "pop ss" 17 0x0 (seq (set ss (loadw 0 16 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0x2)))) aB "por mm0, qword [eax]" 0feb00 aB "por xmm0, xmmword [eax]" 660feb00 aB "prefetch byte [eax]" 0f0d00 @@ -1849,36 +1867,36 @@ aB "punpckldq xmm0, xmmword [eax]" 660f6200 aB "punpcklqdq xmm0, xmmword [eax]" 660f6c00 aB "punpcklwd mm0, qword [eax]" 0f6100 aB "punpcklwd xmm0, xmmword [eax]" 660f6100 -a "push 0" 6a00 -a "pushal" 60 -a "push cs" 0e -a "push ds" 1e -a "push dword [eax+8]" ff7008 -a "push dword [eax]" ff30 -a "push dword [ebp+4]" ff7504 -a "push dword [ebp]" ff7500 -a "push dword [ebx+4]" ff7304 -a "push dword [ecx]" ff31 -a "push dword [edi]" ff37 -a "push dword [esi+4]" ff7604 -a "push dword [esi]" ff36 -a "push dword [esp+4]" ff742404 -a "push dword [esp]" ff3424 -a "push [esp+4]" ff742404 -a "push [esp]" ff3424 -a "push eax" 50 -a "push ebp" 55 -a "push ebx" 53 -a "push ecx" 51 -a "push edi" 57 -a "push edx" 52 -a "push es" 06 -a "push esi" 56 -a "push esp" 54 -a "pushfd" 9c -a "push fs" 0fa0 -a "push gs" 0fa8 -a "push ss" 16 +a "push 0" 6a00 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (bv 32 0x0)))) +a "pushal" 60 0x0 (seq (set _esp (var esp)) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var eax))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var ecx))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var edx))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var ebx))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var _esp))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var ebp))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var esi))) (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var edi)))) +a "push cs" 0e 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var cs)))) +a "push ds" 1e 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var ds)))) +a "push dword [eax+8]" ff7008 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (loadw 0 32 (+ (var eax) (bv 32 0x8)))))) +a "push dword [eax]" ff30 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (loadw 0 32 (+ (var eax) (bv 32 0x0)))))) +a "push dword [ebp+4]" ff7504 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (loadw 0 32 (+ (var ebp) (bv 32 0x4)))))) +a "push dword [ebp]" ff7500 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (loadw 0 32 (+ (var ebp) (bv 32 0x0)))))) +a "push dword [ebx+4]" ff7304 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (loadw 0 32 (+ (var ebx) (bv 32 0x4)))))) +a "push dword [ecx]" ff31 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (loadw 0 32 (+ (var ecx) (bv 32 0x0)))))) +a "push dword [edi]" ff37 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (loadw 0 32 (+ (var edi) (bv 32 0x0)))))) +a "push dword [esi+4]" ff7604 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (loadw 0 32 (+ (var esi) (bv 32 0x4)))))) +a "push dword [esi]" ff36 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (loadw 0 32 (+ (var esi) (bv 32 0x0)))))) +a "push dword [esp+4]" ff742404 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (loadw 0 32 (+ (var esp) (bv 32 0x4)))))) +a "push dword [esp]" ff3424 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (loadw 0 32 (+ (var esp) (bv 32 0x0)))))) +a "push [esp+4]" ff742404 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (loadw 0 32 (+ (var esp) (bv 32 0x4)))))) +a "push [esp]" ff3424 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (loadw 0 32 (+ (var esp) (bv 32 0x0)))))) +a "push eax" 50 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var eax)))) +a "push ebp" 55 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var ebp)))) +a "push ebx" 53 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var ebx)))) +a "push ecx" 51 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var ecx)))) +a "push edi" 57 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var edi)))) +a "push edx" 52 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var edx)))) +a "push es" 06 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var es)))) +a "push esi" 56 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var esi)))) +a "push esp" 54 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var esp)))) +a "pushfd" 9c 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (ite false (bv 32 0x1) (bv 32 0x0)) (bv 32 0x1) false) (ite (var nt) (bv 32 0x1) (bv 32 0x0))) (bv 32 0x2) false) (bv 32 0x3)) (bv 32 0x1) false) (ite (var of) (bv 32 0x1) (bv 32 0x0))) (bv 32 0x1) false) (ite (var df) (bv 32 0x1) (bv 32 0x0))) (bv 32 0x1) false) (ite (var if) (bv 32 0x1) (bv 32 0x0))) (bv 32 0x1) false) (ite (var tf) (bv 32 0x1) (bv 32 0x0))) (bv 32 0x1) false) (ite (var zf) (bv 32 0x1) (bv 32 0x0))) (bv 32 0x1) false) (ite (var zf) (bv 32 0x1) (bv 32 0x0))) (bv 32 0x2) false) (ite (var af) (bv 32 0x1) (bv 32 0x0))) (bv 32 0x2) false) (ite (var pf) (bv 32 0x1) (bv 32 0x0))) (bv 32 0x1) false) (bv 32 0x1)) (bv 32 0x1) false) (ite (var cf) (bv 32 0x1) (bv 32 0x0)))))) +a "push fs" 0fa0 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var fs)))) +a "push gs" 0fa8 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var gs)))) +a "push ss" 16 0x0 (seq (set esp (- (var esp) (bv 32 0x4))) (storew 0 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)) (cast 32 false (var ss)))) aB "pxor mm0, qword [eax]" 0fef00 aB "pxor xmm0, xmmword [eax]" 660fef00 aB "rcpps xmm0, xmmword [eax]" 0f5300 @@ -1889,17 +1907,32 @@ a "rdtsc" 0f31 a "rdtscp" 0f01f9 a "repne movsb byte es:[edi], byte ptr [esi]" f2a4 a "repz movsb" f3a4 -a "ret" c3 +a "ret" c3 0x0 (seq (set esp (+ (var esp) (bv 32 0x4))) (set esp (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false))))) +ad "ret 0xff" c2ff00 0x0 (seq (set esp (+ (var esp) (bv 32 0x4))) (set esp (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false)))) (set esp (+ (var esp) (bv 32 0xff)))) a "bnd ret" f2c3 a "retf 0" ca0000 -a "retf" cb -a "retw" 66c3 -a "rol byte [eax], 0" c00000 -a "rol byte [eax], 1" d000 -a "rol byte [eax], cl" d200 -a "rol dword [eax], 0" c10000 -a "rol dword [eax], 1" d100 -a "rol dword [eax], cl" d300 +a "retf" cb 0x0 empty +a "retw" 66c3 0x0 (seq (set esp (+ (var esp) (bv 32 0x4))) (set esp (loadw 0 32 (+ (+ (cast 32 false (var esp)) (bv 32 0x0)) (<< (cast 32 false (var ss)) (bv 8 0x4) false))))) +ad "rcl byte [eax], cl" d210 0x0 (seq (set _dest (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set _tmp_cnt (mod (cast 5 false (cast 8 false (var ecx))) (bv 5 0x9))) (set _cnt_mask (cast 5 false (cast 8 false (var ecx)))) (repeat (! (is_zero (var _tmp_cnt))) (seq (set _tmp_cf (msb (var _dest))) (set _dest (+ (<< (var _dest) (bv 8 0x1) false) (ite (var cf) (bv 8 0x1) (bv 8 0x0)))) (set cf (var _tmp_cf)) (set _tmp_cnt (- (var _tmp_cnt) (bv 5 0x1))))) (branch (== (var _cnt_mask) (bv 5 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dest))) +ad "rcl byte [eax], 1" d010 0x0 (seq (set _dest (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set _tmp_cnt (mod (cast 5 false (bv 8 0x1)) (bv 5 0x9))) (set _cnt_mask (cast 5 false (bv 8 0x1))) (repeat (! (is_zero (var _tmp_cnt))) (seq (set _tmp_cf (msb (var _dest))) (set _dest (+ (<< (var _dest) (bv 8 0x1) false) (ite (var cf) (bv 8 0x1) (bv 8 0x0)))) (set cf (var _tmp_cf)) (set _tmp_cnt (- (var _tmp_cnt) (bv 5 0x1))))) (branch (== (var _cnt_mask) (bv 5 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dest))) +ad "rcl dword [eax], cl" d310 0x0 (seq (set _dest (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set _tmp_cnt (cast 5 false (cast 8 false (var ecx)))) (set _cnt_mask (cast 5 false (cast 8 false (var ecx)))) (repeat (! (is_zero (var _tmp_cnt))) (seq (set _tmp_cf (msb (var _dest))) (set _dest (+ (<< (var _dest) (bv 8 0x1) false) (ite (var cf) (bv 32 0x1) (bv 32 0x0)))) (set cf (var _tmp_cf)) (set _tmp_cnt (- (var _tmp_cnt) (bv 5 0x1))))) (branch (== (var _cnt_mask) (bv 5 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dest))) +ad "rcl dword [eax], 1" d110 0x0 (seq (set _dest (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set _tmp_cnt (cast 5 false (bv 32 0x1))) (set _cnt_mask (cast 5 false (bv 32 0x1))) (repeat (! (is_zero (var _tmp_cnt))) (seq (set _tmp_cf (msb (var _dest))) (set _dest (+ (<< (var _dest) (bv 8 0x1) false) (ite (var cf) (bv 32 0x1) (bv 32 0x0)))) (set cf (var _tmp_cf)) (set _tmp_cnt (- (var _tmp_cnt) (bv 5 0x1))))) (branch (== (var _cnt_mask) (bv 5 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dest))) +ad "rcr byte [eax], cl" d218 0x0 (seq (set _dest (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set _tmp_cnt (mod (cast 5 false (cast 8 false (var ecx))) (bv 5 0x9))) (set _cnt_mask (cast 5 false (cast 8 false (var ecx)))) (branch (== (var _cnt_mask) (bv 5 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop) (repeat (! (is_zero (var _tmp_cnt))) (seq (set _tmp_cf (lsb (var _dest))) (set _dest (+ (>> (var _dest) (bv 8 0x1) false) (<< (ite (var cf) (bv 8 0x1) (bv 8 0x0)) (bv 8 0x1) false))) (set cf (var _tmp_cf)) (set _tmp_cnt (- (var _tmp_cnt) (bv 5 0x1))))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dest))) +ad "rcr byte [eax], 1" d018 0x0 (seq (set _dest (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set _tmp_cnt (mod (cast 5 false (bv 8 0x1)) (bv 5 0x9))) (set _cnt_mask (cast 5 false (bv 8 0x1))) (branch (== (var _cnt_mask) (bv 5 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop) (repeat (! (is_zero (var _tmp_cnt))) (seq (set _tmp_cf (lsb (var _dest))) (set _dest (+ (>> (var _dest) (bv 8 0x1) false) (<< (ite (var cf) (bv 8 0x1) (bv 8 0x0)) (bv 8 0x1) false))) (set cf (var _tmp_cf)) (set _tmp_cnt (- (var _tmp_cnt) (bv 5 0x1))))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dest))) +ad "rcr dword [eax], cl" d318 0x0 (seq (set _dest (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set _tmp_cnt (cast 5 false (cast 8 false (var ecx)))) (set _cnt_mask (cast 5 false (cast 8 false (var ecx)))) (branch (== (var _cnt_mask) (bv 5 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop) (repeat (! (is_zero (var _tmp_cnt))) (seq (set _tmp_cf (lsb (var _dest))) (set _dest (+ (>> (var _dest) (bv 8 0x1) false) (<< (ite (var cf) (bv 32 0x1) (bv 32 0x0)) (bv 8 0x4) false))) (set cf (var _tmp_cf)) (set _tmp_cnt (- (var _tmp_cnt) (bv 5 0x1))))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dest))) +ad "rcr dword [eax], 1" d118 0x0 (seq (set _dest (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set _tmp_cnt (cast 5 false (bv 32 0x1))) (set _cnt_mask (cast 5 false (bv 32 0x1))) (branch (== (var _cnt_mask) (bv 5 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop) (repeat (! (is_zero (var _tmp_cnt))) (seq (set _tmp_cf (lsb (var _dest))) (set _dest (+ (>> (var _dest) (bv 8 0x1) false) (<< (ite (var cf) (bv 32 0x1) (bv 32 0x0)) (bv 8 0x4) false))) (set cf (var _tmp_cf)) (set _tmp_cnt (- (var _tmp_cnt) (bv 5 0x1))))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dest))) +ad "rol byte [eax], 0" c00000 0x0 (seq (set _dest (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set _cnt_mask (bv 8 0x1f)) (set _cnt (bv 8 0x0)) (set _masked (& (var _cnt_mask) (var _cnt))) (set _tmp_cnt (mod (var _masked) (bv 8 0x1))) (repeat (! (is_zero (var _tmp_cnt))) (seq (set _tmp_cf (msb (var _dest))) (set _dest (+ (<< (var _dest) (bv 8 0x1) false) (ite (var _tmp_cf) (bv 8 0x1) (bv 8 0x0)))) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (! (is_zero (var _masked))) (set cf (lsb (var _dest))) nop) (branch (== (var _masked) (bv 8 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dest))) +ad "rol byte [eax], 1" d000 0x0 (seq (set _dest (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set _cnt_mask (bv 8 0x1f)) (set _cnt (bv 8 0x1)) (set _masked (& (var _cnt_mask) (var _cnt))) (set _tmp_cnt (mod (var _masked) (bv 8 0x1))) (repeat (! (is_zero (var _tmp_cnt))) (seq (set _tmp_cf (msb (var _dest))) (set _dest (+ (<< (var _dest) (bv 8 0x1) false) (ite (var _tmp_cf) (bv 8 0x1) (bv 8 0x0)))) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (! (is_zero (var _masked))) (set cf (lsb (var _dest))) nop) (branch (== (var _masked) (bv 8 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dest))) +ad "rol byte [eax], cl" d200 0x0 (seq (set _dest (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set _cnt_mask (bv 8 0x1f)) (set _cnt (cast 8 false (var ecx))) (set _masked (& (var _cnt_mask) (var _cnt))) (set _tmp_cnt (mod (var _masked) (bv 8 0x1))) (repeat (! (is_zero (var _tmp_cnt))) (seq (set _tmp_cf (msb (var _dest))) (set _dest (+ (<< (var _dest) (bv 8 0x1) false) (ite (var _tmp_cf) (bv 8 0x1) (bv 8 0x0)))) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (! (is_zero (var _masked))) (set cf (lsb (var _dest))) nop) (branch (== (var _masked) (bv 8 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dest))) +ad "rol dword [eax], 0" c10000 0x0 (seq (set _dest (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set _cnt_mask (bv 8 0x1f)) (set _cnt (bv 8 0x0)) (set _masked (& (var _cnt_mask) (var _cnt))) (set _tmp_cnt (mod (var _masked) (bv 8 0x4))) (repeat (! (is_zero (var _tmp_cnt))) (seq (set _tmp_cf (msb (var _dest))) (set _dest (+ (<< (var _dest) (bv 8 0x1) false) (ite (var _tmp_cf) (bv 32 0x1) (bv 32 0x0)))) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (! (is_zero (var _masked))) (set cf (lsb (var _dest))) nop) (branch (== (var _masked) (bv 8 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dest))) +ad "rol dword [eax], 1" d100 0x0 (seq (set _dest (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set _cnt_mask (bv 32 0x1f)) (set _cnt (bv 32 0x1)) (set _masked (& (var _cnt_mask) (var _cnt))) (set _tmp_cnt (mod (var _masked) (bv 32 0x4))) (repeat (! (is_zero (var _tmp_cnt))) (seq (set _tmp_cf (msb (var _dest))) (set _dest (+ (<< (var _dest) (bv 8 0x1) false) (ite (var _tmp_cf) (bv 32 0x1) (bv 32 0x0)))) (set _tmp_cnt (- (var _tmp_cnt) (bv 32 0x1))))) (branch (! (is_zero (var _masked))) (set cf (lsb (var _dest))) nop) (branch (== (var _masked) (bv 32 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dest))) +ad "rol dword [eax], cl" d300 0x0 (seq (set _dest (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set _cnt_mask (bv 8 0x1f)) (set _cnt (cast 8 false (var ecx))) (set _masked (& (var _cnt_mask) (var _cnt))) (set _tmp_cnt (mod (var _masked) (bv 8 0x4))) (repeat (! (is_zero (var _tmp_cnt))) (seq (set _tmp_cf (msb (var _dest))) (set _dest (+ (<< (var _dest) (bv 8 0x1) false) (ite (var _tmp_cf) (bv 32 0x1) (bv 32 0x0)))) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (! (is_zero (var _masked))) (set cf (lsb (var _dest))) nop) (branch (== (var _masked) (bv 8 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dest))) +ad "ror byte [eax], 0" c00800 0x0 (seq (set _dest (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set _cnt_mask (bv 8 0x1f)) (set _cnt (bv 8 0x0)) (set _masked (& (var _cnt_mask) (var _cnt))) (set _tmp_cnt (mod (var _masked) (bv 8 0x1))) (repeat (! (is_zero (var _tmp_cnt))) (seq (set _tmp_cf (lsb (var _dest))) (set _dest (+ (>> (var _dest) (bv 8 0x1) false) (<< (ite (var _tmp_cf) (bv 8 0x1) (bv 8 0x0)) (bv 8 0x1) false))) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (! (is_zero (var _masked))) (set cf (msb (var _dest))) nop) (branch (== (var _masked) (bv 8 0x1)) (set of (^^ (msb (var _dest)) (msb (<< (var _dest) (bv 8 0x1) false)))) nop) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dest))) +ad "ror byte [eax], 1" d008 0x0 (seq (set _dest (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set _cnt_mask (bv 8 0x1f)) (set _cnt (bv 8 0x1)) (set _masked (& (var _cnt_mask) (var _cnt))) (set _tmp_cnt (mod (var _masked) (bv 8 0x1))) (repeat (! (is_zero (var _tmp_cnt))) (seq (set _tmp_cf (lsb (var _dest))) (set _dest (+ (>> (var _dest) (bv 8 0x1) false) (<< (ite (var _tmp_cf) (bv 8 0x1) (bv 8 0x0)) (bv 8 0x1) false))) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (! (is_zero (var _masked))) (set cf (msb (var _dest))) nop) (branch (== (var _masked) (bv 8 0x1)) (set of (^^ (msb (var _dest)) (msb (<< (var _dest) (bv 8 0x1) false)))) nop) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dest))) +ad "ror byte [eax], cl" d208 0x0 (seq (set _dest (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set _cnt_mask (bv 8 0x1f)) (set _cnt (cast 8 false (var ecx))) (set _masked (& (var _cnt_mask) (var _cnt))) (set _tmp_cnt (mod (var _masked) (bv 8 0x1))) (repeat (! (is_zero (var _tmp_cnt))) (seq (set _tmp_cf (lsb (var _dest))) (set _dest (+ (>> (var _dest) (bv 8 0x1) false) (<< (ite (var _tmp_cf) (bv 8 0x1) (bv 8 0x0)) (bv 8 0x1) false))) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (! (is_zero (var _masked))) (set cf (msb (var _dest))) nop) (branch (== (var _masked) (bv 8 0x1)) (set of (^^ (msb (var _dest)) (msb (<< (var _dest) (bv 8 0x1) false)))) nop) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dest))) +ad "ror dword [eax], 0" c10800 0x0 (seq (set _dest (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set _cnt_mask (bv 8 0x1f)) (set _cnt (bv 8 0x0)) (set _masked (& (var _cnt_mask) (var _cnt))) (set _tmp_cnt (mod (var _masked) (bv 8 0x4))) (repeat (! (is_zero (var _tmp_cnt))) (seq (set _tmp_cf (lsb (var _dest))) (set _dest (+ (>> (var _dest) (bv 8 0x1) false) (<< (ite (var _tmp_cf) (bv 32 0x1) (bv 32 0x0)) (bv 8 0x4) false))) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (! (is_zero (var _masked))) (set cf (msb (var _dest))) nop) (branch (== (var _masked) (bv 8 0x1)) (set of (^^ (msb (var _dest)) (msb (<< (var _dest) (bv 8 0x1) false)))) nop) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dest))) +ad "ror dword [eax], 1" d108 0x0 (seq (set _dest (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set _cnt_mask (bv 32 0x1f)) (set _cnt (bv 32 0x1)) (set _masked (& (var _cnt_mask) (var _cnt))) (set _tmp_cnt (mod (var _masked) (bv 32 0x4))) (repeat (! (is_zero (var _tmp_cnt))) (seq (set _tmp_cf (lsb (var _dest))) (set _dest (+ (>> (var _dest) (bv 8 0x1) false) (<< (ite (var _tmp_cf) (bv 32 0x1) (bv 32 0x0)) (bv 8 0x4) false))) (set _tmp_cnt (- (var _tmp_cnt) (bv 32 0x1))))) (branch (! (is_zero (var _masked))) (set cf (msb (var _dest))) nop) (branch (== (var _masked) (bv 32 0x1)) (set of (^^ (msb (var _dest)) (msb (<< (var _dest) (bv 8 0x1) false)))) nop) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dest))) +ad "ror dword [eax], cl" d308 0x0 (seq (set _dest (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set _cnt_mask (bv 8 0x1f)) (set _cnt (cast 8 false (var ecx))) (set _masked (& (var _cnt_mask) (var _cnt))) (set _tmp_cnt (mod (var _masked) (bv 8 0x4))) (repeat (! (is_zero (var _tmp_cnt))) (seq (set _tmp_cf (lsb (var _dest))) (set _dest (+ (>> (var _dest) (bv 8 0x1) false) (<< (ite (var _tmp_cf) (bv 32 0x1) (bv 32 0x0)) (bv 8 0x4) false))) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (! (is_zero (var _masked))) (set cf (msb (var _dest))) nop) (branch (== (var _masked) (bv 8 0x1)) (set of (^^ (msb (var _dest)) (msb (<< (var _dest) (bv 8 0x1) false)))) nop) (storew 0 (+ (var eax) (bv 32 0x0)) (var _dest))) aB "roundpd xmm0, xmm0, 0" 660f3a09c000 aB "roundps xmm0, xmm0, 0" 660f3a08c000 aB "roundsd xmm0, xmm0, 0" 660f3a0bc000 @@ -1907,15 +1940,7 @@ aB "roundss xmm0, xmm0, 0" 660f3a0ac000 a "rsm" 0faa aB "rsqrtps xmm0, xmmword [eax]" 0f5200 aB "rsqrtss xmm0, dword [eax]" f30f5200 -a "sahf" 9e a "salc" d6 -a "sbb al, 0" 1c00 -a "sbb al, byte [eax]" 1a00 -a "sbb byte [eax], al" 1800 -a "sbb dword [eax], eAX" 1900 -a "sbb eax, dword [eax]" 1b00 -a "scasb al, byte es:[edi]" ae -a "scasd eax, dword es:[edi]" af a "seta byte [eax]" 0f9700 a "setae byte [eax]" 0f9300 a "setb byte [eax]" 0f9200 @@ -1936,7 +1961,10 @@ a "sfence" 0faef8 a "sgdt [eax]" 0f0100 aB "shld dword [eax], eax, 0" 0fa40000 aB "shld dword [eax], eax, cl" 0fa500 -a "shl edx, 5" c1e205 +ad "sar edx, 5" c1fa05 0x0 (seq (set _cnt (bv 8 0x5)) (set _cnt_mask (bv 8 0x3f)) (set _masked (& (var _cnt) (var _cnt_mask))) (set _tmp_cnt (var _masked)) (set _dest (var edx)) (set _tmp_dest (var _dest)) (repeat (! (is_zero (var _tmp_cnt))) (seq (set cf (lsb (var _dest))) (set _dest (>> (var _dest) (bv 8 0x1) (msb (var _dest)))) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (== (var _masked) (bv 8 0x1)) (set of false) nop)) +ad "sal edx, 5" c1f205 0x0 (seq (set _cnt (bv 8 0x5)) (set _cnt_mask (bv 8 0x3f)) (set _masked (& (var _cnt) (var _cnt_mask))) (set _tmp_cnt (var _masked)) (set _dest (var edx)) (set _tmp_dest (var _dest)) (repeat (! (is_zero (var _tmp_cnt))) (seq (set cf (msb (var _dest))) (set _dest (<< (var _dest) (bv 8 0x1) false)) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (== (var _masked) (bv 8 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop)) +ad "shl edx, 5" c1e205 0x0 (seq (set _cnt (bv 8 0x5)) (set _cnt_mask (bv 8 0x3f)) (set _masked (& (var _cnt) (var _cnt_mask))) (set _tmp_cnt (var _masked)) (set _dest (var edx)) (set _tmp_dest (var _dest)) (repeat (! (is_zero (var _tmp_cnt))) (seq (set cf (msb (var _dest))) (set _dest (<< (var _dest) (bv 8 0x1) false)) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (== (var _masked) (bv 8 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop)) +ad "shr edx, 5" c1ea05 0x0 (seq (set _cnt (bv 8 0x5)) (set _cnt_mask (bv 8 0x3f)) (set _masked (& (var _cnt) (var _cnt_mask))) (set _tmp_cnt (var _masked)) (set _dest (var edx)) (set _tmp_dest (var _dest)) (repeat (! (is_zero (var _tmp_cnt))) (seq (set cf (lsb (var _dest))) (set _dest (>> (var _dest) (bv 8 0x1) false)) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (== (var _masked) (bv 8 0x1)) (set of (msb (var _tmp_dest))) nop)) aB "shrd dword [eax], eax, 0" 0fac0000 aB "shrd dword [eax], eax, cl" 0fad00 aB "shufpd xmm0, xmmword [eax], 0x0" 660fc60000 @@ -1951,41 +1979,36 @@ aB "sqrtpd xmm0, xmmword [eax]" 660f5100 aB "sqrtps xmm0, xmmword [eax]" 0f5100 aB "sqrtsd xmm0, qword [eax]" f20f5100 aB "sqrtss xmm0, dword [eax]" f30f5100 -a "stc" f9 -a "std" fd a "stgi" 0f01dc -a "sti" fb a "stmxcsr dword [eax]" 0fae18 -a "stosb byte es:[edi], al" aa -a "stosd dword es:[edi], eax" ab a "str word [eax]" 0f0008 -a "sub al, 0" 2c00 -a "sub al, byte [eax]" 2a00 -a "sub byte [eax], al" 2800 -a "sub dword [eax], 1" 832801 -a "sub dword [eax+4], -666" 81680466fdffff -a "sub dword [eax+4], 666" 8168049a020000 -a "sub dword [eax+666], 666" 81a89a0200009a020000 -a "sub dword [eax], 666" 81289a020000 -a "sub dword [eax], eax" 2900 -a "sub dword [ebp+4], 1" 836d0401 -a "sub dword [ebp+555], 1" 83ad2b02000001 -a "sub dword [ebp+555], 7357" 81ad2b020000bd1c0000 -a "sub dword [ebp-555], 7357" 81add5fdffffbd1c0000 -a "sub dword [ebx], 1" 832b01 -a "sub eax, 3" 83e803 -a "sub eax, -666" 2d66fdffff -a "sub eax, 666" 2d9a020000 -a "sub eax, dword [eax]" 2b00 -a "sub eax, eax" 29c0 -a "sub eax, ebx" 29d8 -a "sub ebx, 3" 83eb03 -a "sub ebx, -3" 83ebfd -a "sub ebx, 666" 81eb9a020000 -a "sub [ebx], eax" 2903 -a "sub ebx, eax" 29c3 -a "sub ecx, 666" 81e99a020000 -a "sub esi,-334" 81eeb2feffff +a "sub al, 0" 2c00 0x0 (seq (set op1 (cast 8 false (var eax))) (set op2 (bv 8 0x0)) (set sub (- (var op1) (var op2))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var sub)))) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub al, byte [eax]" 2a00 0x0 (seq (set op1 (cast 8 false (var eax))) (set op2 (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set sub (- (var op1) (var op2))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var sub)))) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub byte [eax], al" 2800 0x0 (seq (set op1 (loadw 0 8 (+ (var eax) (bv 32 0x0)))) (set op2 (cast 8 false (var eax))) (set sub (- (var op1) (var op2))) (storew 0 (+ (var eax) (bv 32 0x0)) (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub dword [eax], 1" 832801 0x0 (seq (set op1 (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set op2 (bv 32 0x1)) (set sub (- (var op1) (var op2))) (storew 0 (+ (var eax) (bv 32 0x0)) (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub dword [eax+4], -666" 81680466fdffff 0x0 (seq (set op1 (loadw 0 32 (+ (var eax) (bv 32 0x4)))) (set op2 (bv 32 0xfffffd66)) (set sub (- (var op1) (var op2))) (storew 0 (+ (var eax) (bv 32 0x4)) (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub dword [eax+4], 666" 8168049a020000 0x0 (seq (set op1 (loadw 0 32 (+ (var eax) (bv 32 0x4)))) (set op2 (bv 32 0x29a)) (set sub (- (var op1) (var op2))) (storew 0 (+ (var eax) (bv 32 0x4)) (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub dword [eax+666], 666" 81a89a0200009a020000 0x0 (seq (set op1 (loadw 0 32 (+ (var eax) (bv 32 0x29a)))) (set op2 (bv 32 0x29a)) (set sub (- (var op1) (var op2))) (storew 0 (+ (var eax) (bv 32 0x29a)) (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub dword [eax], 666" 81289a020000 0x0 (seq (set op1 (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set op2 (bv 32 0x29a)) (set sub (- (var op1) (var op2))) (storew 0 (+ (var eax) (bv 32 0x0)) (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub dword [eax], eax" 2900 0x0 (seq (set op1 (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set op2 (var eax)) (set sub (- (var op1) (var op2))) (storew 0 (+ (var eax) (bv 32 0x0)) (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub dword [ebp+4], 1" 836d0401 0x0 (seq (set op1 (loadw 0 32 (+ (var ebp) (bv 32 0x4)))) (set op2 (bv 32 0x1)) (set sub (- (var op1) (var op2))) (storew 0 (+ (var ebp) (bv 32 0x4)) (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub dword [ebp+555], 1" 83ad2b02000001 0x0 (seq (set op1 (loadw 0 32 (+ (var ebp) (bv 32 0x22b)))) (set op2 (bv 32 0x1)) (set sub (- (var op1) (var op2))) (storew 0 (+ (var ebp) (bv 32 0x22b)) (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub dword [ebp+555], 7357" 81ad2b020000bd1c0000 0x0 (seq (set op1 (loadw 0 32 (+ (var ebp) (bv 32 0x22b)))) (set op2 (bv 32 0x1cbd)) (set sub (- (var op1) (var op2))) (storew 0 (+ (var ebp) (bv 32 0x22b)) (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub dword [ebp-555], 7357" 81add5fdffffbd1c0000 0x0 (seq (set op1 (loadw 0 32 (+ (var ebp) (bv 32 0xfffffdd5)))) (set op2 (bv 32 0x1cbd)) (set sub (- (var op1) (var op2))) (storew 0 (+ (var ebp) (bv 32 0xfffffdd5)) (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub dword [ebx], 1" 832b01 0x0 (seq (set op1 (loadw 0 32 (+ (var ebx) (bv 32 0x0)))) (set op2 (bv 32 0x1)) (set sub (- (var op1) (var op2))) (storew 0 (+ (var ebx) (bv 32 0x0)) (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub eax, 3" 83e803 0x0 (seq (set op1 (var eax)) (set op2 (bv 32 0x3)) (set sub (- (var op1) (var op2))) (set eax (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub eax, -666" 2d66fdffff 0x0 (seq (set op1 (var eax)) (set op2 (bv 32 0xfffffd66)) (set sub (- (var op1) (var op2))) (set eax (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub eax, 666" 2d9a020000 0x0 (seq (set op1 (var eax)) (set op2 (bv 32 0x29a)) (set sub (- (var op1) (var op2))) (set eax (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub eax, dword [eax]" 2b00 0x0 (seq (set op1 (var eax)) (set op2 (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set sub (- (var op1) (var op2))) (set eax (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub eax, eax" 29c0 0x0 (seq (set op1 (var eax)) (set op2 (var eax)) (set sub (- (var op1) (var op2))) (set eax (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub eax, ebx" 29d8 0x0 (seq (set op1 (var eax)) (set op2 (var ebx)) (set sub (- (var op1) (var op2))) (set eax (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub ebx, 3" 83eb03 0x0 (seq (set op1 (var ebx)) (set op2 (bv 32 0x3)) (set sub (- (var op1) (var op2))) (set ebx (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub ebx, -3" 83ebfd 0x0 (seq (set op1 (var ebx)) (set op2 (bv 32 0xfffffffd)) (set sub (- (var op1) (var op2))) (set ebx (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub ebx, 666" 81eb9a020000 0x0 (seq (set op1 (var ebx)) (set op2 (bv 32 0x29a)) (set sub (- (var op1) (var op2))) (set ebx (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub [ebx], eax" 2903 0x0 (seq (set op1 (loadw 0 32 (+ (var ebx) (bv 32 0x0)))) (set op2 (var eax)) (set sub (- (var op1) (var op2))) (storew 0 (+ (var ebx) (bv 32 0x0)) (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub ebx, eax" 29c3 0x0 (seq (set op1 (var ebx)) (set op2 (var eax)) (set sub (- (var op1) (var op2))) (set ebx (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub ecx, 666" 81e99a020000 0x0 (seq (set op1 (var ecx)) (set op2 (bv 32 0x29a)) (set sub (- (var op1) (var op2))) (set ecx (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub esi,-334" 81eeb2feffff 0x0 (seq (set op1 (var esi)) (set op2 (bv 32 0xfffffeb2)) (set sub (- (var op1) (var op2))) (set esi (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) aB "subpd xmm0, xmmword [eax]" 660f5c00 aB "subps xmm0, xmmword [eax]" 0f5c00 aB "subsd xmm0, qword [eax]" f20f5c00 @@ -1995,14 +2018,14 @@ a "syscall" 0f05 a "sysenter" 0f34 a "sysexit" 0f35 a "sysret" 0f07 -a "test al, 0" f6c000 -a "test byte [eax], 0" f60000 -a "test byte [eax], al" 8400 -a "test dword [eax], 0" f70000000000 -a "test dword [eax], eax" 8500 -a "test eax, 0" f7c000000000 -a "test eax, ebx" 85d8 -a "test edx, esi" 85f2 +a "test al, 0" f6c000 0x0 (seq (set _res (& (cast 8 false (var eax)) (bv 8 0x0))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _res)))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +a "test byte [eax], 0" f60000 0x0 (seq (set _res (& (loadw 0 8 (+ (var eax) (bv 32 0x0))) (bv 8 0x0))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +a "test byte [eax], al" 8400 0x0 (seq (set _res (& (loadw 0 8 (+ (var eax) (bv 32 0x0))) (cast 8 false (var eax)))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +a "test dword [eax], 0" f70000000000 0x0 (seq (set _res (& (loadw 0 32 (+ (var eax) (bv 32 0x0))) (bv 32 0x0))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +a "test dword [eax], eax" 8500 0x0 (seq (set _res (& (loadw 0 32 (+ (var eax) (bv 32 0x0))) (var eax))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +a "test eax, 0" f7c000000000 0x0 (seq (set _res (& (var eax) (bv 32 0x0))) (set eax (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +a "test eax, ebx" 85d8 0x0 (seq (set _res (& (var eax) (var ebx))) (set eax (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +a "test edx, esi" 85f2 0x0 (seq (set _res (& (var edx) (var esi))) (set edx (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) aB "ucomisd xmm0, qword [eax]" 660f2e00 aB "ucomiss xmm0, dword [eax]" 0f2e00 a "ud2" 0f0b @@ -2147,147 +2170,145 @@ a "wrmsr" 0f30 aB "xadd byte [eax], al" 0fc000 aB "xadd dword [eax], eax" 0fc100 aB "xchg byte [eax], al" 8600 -a "xchg dword [eax], eax" 8700 -ad "xchg al, dl" 86d0 -ad "xchg dl, al" 86c2 -ad "xchg ax, dx" 6692 -a "xchg dx, ax" 6692 -ad "xchg ah, dh" 86f4 -ad "xchg dh, ah" 86e6 -a "xchg eax, eax" 90 -ad "xchg eax, ebp" 95 -ad "xchg eax, ebx" 93 -ad "xchg eax, ebx" 93 -ad "xchg eax, ecx" 91 -ad "xchg eax, edi" 97 -ad "xchg eax, edx" 92 -ad "xchg eax, esi" 96 -ad "xchg eax, esp" 94 -ad "xchg ebx, ecx" 87cb -ad "xchg ecx, ebp" 87e9 -ad "xchg ecx, ebx" 87d9 -ad "xchg ecx, ecx" 87c9 +a "xchg dword [eax], eax" 8700 0x0 (seq (set _temp (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (storew 0 (+ (var eax) (bv 32 0x0)) (var eax)) (set eax (var _temp))) +ad "xchg al, dl" 86d0 0x0 (seq (set _temp (cast 8 false (var eax))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (cast 8 false (var edx))))) (set edx (| (& (var edx) (~ (bv 32 0xff))) (cast 32 false (var _temp))))) +ad "xchg dl, al" 86c2 0x0 (seq (set _temp (cast 8 false (var edx))) (set edx (| (& (var edx) (~ (bv 32 0xff))) (cast 32 false (cast 8 false (var eax))))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _temp))))) +ad "xchg ax, dx" 6692 0x0 (seq (set _temp (cast 16 false (var eax))) (set eax (| (& (var eax) (~ (bv 32 0xffff))) (cast 32 false (cast 16 false (var edx))))) (set edx (| (& (var edx) (~ (bv 32 0xffff))) (cast 32 false (var _temp))))) +a "xchg dx, ax" 6692 0x0 (seq (set _temp (cast 16 false (var eax))) (set eax (| (& (var eax) (~ (bv 32 0xffff))) (cast 32 false (cast 16 false (var edx))))) (set edx (| (& (var edx) (~ (bv 32 0xffff))) (cast 32 false (var _temp))))) +ad "xchg ah, dh" 86f4 0x0 (seq (set _temp (cast 8 false (>> (var eax) (bv 8 0x8) false))) (set eax (| (& (var eax) (~ (bv 32 0xff00))) (<< (cast 32 false (cast 8 false (>> (var edx) (bv 8 0x8) false))) (bv 8 0x8) false))) (set edx (| (& (var edx) (~ (bv 32 0xff00))) (<< (cast 32 false (var _temp)) (bv 8 0x8) false)))) +ad "xchg dh, ah" 86e6 0x0 (seq (set _temp (cast 8 false (>> (var edx) (bv 8 0x8) false))) (set edx (| (& (var edx) (~ (bv 32 0xff00))) (<< (cast 32 false (cast 8 false (>> (var eax) (bv 8 0x8) false))) (bv 8 0x8) false))) (set eax (| (& (var eax) (~ (bv 32 0xff00))) (<< (cast 32 false (var _temp)) (bv 8 0x8) false)))) +a "xchg eax, eax" 90 0x0 nop +ad "xchg eax, ebp" 95 0x0 (seq (set _temp (var eax)) (set eax (var ebp)) (set ebp (var _temp))) +ad "xchg eax, ebx" 93 0x0 (seq (set _temp (var eax)) (set eax (var ebx)) (set ebx (var _temp))) +ad "xchg eax, ebx" 93 0x0 (seq (set _temp (var eax)) (set eax (var ebx)) (set ebx (var _temp))) +ad "xchg eax, ecx" 91 0x0 (seq (set _temp (var eax)) (set eax (var ecx)) (set ecx (var _temp))) +ad "xchg eax, edi" 97 0x0 (seq (set _temp (var eax)) (set eax (var edi)) (set edi (var _temp))) +ad "xchg eax, edx" 92 0x0 (seq (set _temp (var eax)) (set eax (var edx)) (set edx (var _temp))) +ad "xchg eax, esi" 96 0x0 (seq (set _temp (var eax)) (set eax (var esi)) (set esi (var _temp))) +ad "xchg eax, esp" 94 0x0 (seq (set _temp (var eax)) (set eax (var esp)) (set esp (var _temp))) +ad "xchg ebx, ecx" 87cb 0x0 (seq (set _temp (var ebx)) (set ebx (var ecx)) (set ecx (var _temp))) +ad "xchg ecx, ebp" 87e9 0x0 (seq (set _temp (var ecx)) (set ecx (var ebp)) (set ebp (var _temp))) +ad "xchg ecx, ebx" 87d9 0x0 (seq (set _temp (var ecx)) (set ecx (var ebx)) (set ebx (var _temp))) +ad "xchg ecx, ecx" 87c9 0x0 (seq (set _temp (var ecx)) (set ecx (var ecx)) (set ecx (var _temp))) a "xgetbv" 0f01d0 -a "xlatb" d7 -a "xor al, 0" 3400 -a "xor al, 0x80" 3480 -a "xor ax, 0x8080" 66358080 -a "xor ax, 0x8" 6683f008 -a "xor cx, 0x8080" 6681f18080 -a "xor sp, 0x8080" 6681f48080 -a "xor bp, 0x8080" 6681f58080 -a "xor si, 0x8" 6683f608 -a "xor al, byte [eax]" 3200 -a "xor byte [eax], al" 3000 -a "xor byte [eax], 0xff" 8030ff -a "xor dword [eax], eax" 3100 -a "xor eax, dword [eax]" 3300 -a "xor [eax], eax" 3100 -a "xor eax, eax" 31c0 -a "xor eax, ebx" 31d8 -a "xor ebx, eax" 31c3 -a "xor esi, ebp" 31ee -a "xor esp,esp" 31e4 +a "xor al, 0" 3400 0x0 (seq (set _xor (^ (cast 8 false (var eax)) (bv 8 0x0))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _xor)))) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor al, 0x80" 3480 0x0 (seq (set _xor (^ (cast 8 false (var eax)) (bv 8 0x80))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _xor)))) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor ax, 0x8080" 66358080 0x0 (seq (set _xor (^ (cast 16 false (var eax)) (bv 16 0x8080))) (set eax (| (& (var eax) (~ (bv 32 0xffff))) (cast 32 false (var _xor)))) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor ax, 0x8" 6683f008 0x0 (seq (set _xor (^ (cast 16 false (var eax)) (bv 16 0x8))) (set eax (| (& (var eax) (~ (bv 32 0xffff))) (cast 32 false (var _xor)))) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor cx, 0x8080" 6681f18080 0x0 (seq (set _xor (^ (cast 16 false (var ecx)) (bv 16 0x8080))) (set ecx (| (& (var ecx) (~ (bv 32 0xffff))) (cast 32 false (var _xor)))) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor sp, 0x8080" 6681f48080 0x0 (seq (set _xor (^ (cast 16 false (var esp)) (bv 16 0x8080))) (set esp (| (& (var esp) (~ (bv 32 0xffff))) (cast 32 false (var _xor)))) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor bp, 0x8080" 6681f58080 0x0 (seq (set _xor (^ (cast 16 false (var ebp)) (bv 16 0x8080))) (set ebp (| (& (var ebp) (~ (bv 32 0xffff))) (cast 32 false (var _xor)))) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor si, 0x8" 6683f608 0x0 (seq (set _xor (^ (cast 16 false (var esi)) (bv 16 0x8))) (set esi (| (& (var esi) (~ (bv 32 0xffff))) (cast 32 false (var _xor)))) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor al, byte [eax]" 3200 0x0 (seq (set _xor (^ (cast 8 false (var eax)) (loadw 0 8 (+ (var eax) (bv 32 0x0))))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _xor)))) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor byte [eax], al" 3000 0x0 (seq (set _xor (^ (loadw 0 8 (+ (var eax) (bv 32 0x0))) (cast 8 false (var eax)))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor byte [eax], 0xff" 8030ff 0x0 (seq (set _xor (^ (loadw 0 8 (+ (var eax) (bv 32 0x0))) (bv 8 0xff))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor dword [eax], eax" 3100 0x0 (seq (set _xor (^ (loadw 0 32 (+ (var eax) (bv 32 0x0))) (var eax))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor eax, dword [eax]" 3300 0x0 (seq (set _xor (^ (var eax) (loadw 0 32 (+ (var eax) (bv 32 0x0))))) (set eax (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor [eax], eax" 3100 0x0 (seq (set _xor (^ (loadw 0 32 (+ (var eax) (bv 32 0x0))) (var eax))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor eax, eax" 31c0 0x0 (seq (set _xor (^ (var eax) (var eax))) (set eax (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor eax, ebx" 31d8 0x0 (seq (set _xor (^ (var eax) (var ebx))) (set eax (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor ebx, eax" 31c3 0x0 (seq (set _xor (^ (var ebx) (var eax))) (set ebx (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor esi, ebp" 31ee 0x0 (seq (set _xor (^ (var esi) (var ebp))) (set esi (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor esp,esp" 31e4 0x0 (seq (set _xor (^ (var esp) (var esp))) (set esp (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) aB "xorpd xmm0, xmmword [eax]" 660f5700 aB "xorps xmm0, xmmword [eax]" 0f5700 aB "xrstor [eax]" 0fae28 aB "xsave [eax]" 0fae20 a "xsetbv" 0f01d1 -a "nop" 90 -a "int 0x80" cd80 -a "mov eax, 33" b821000000 -a "mov rax, 33" 48c7c021000000 -a "mov [ebp+4],0" c7450400000000 -a "jmp 0x1b" eb05 0x14 +a "int 0x80" cd80 0x0 (seq (goto int) empty) +a "mov eax, 33" b821000000 0x0 (set eax (bv 32 0x21)) +aB "mov rax, 33" 48c7c021000000 0x0 (set eax (bv 32 0x21)) +a "mov [ebp+4],0" c7450400000000 0x0 (storew 0 (+ (var ebp) (bv 32 0x4)) (bv 32 0x0)) +a "jmp 0x1b" eb05 0x14 (jmp (+ (bv 32 0x14) (bv 32 0x1b))) ad "sete al" 0f94c0 -a "mov byte ptr [bp+di],0x0" 67c60300 -a "mov byte ptr [bp+di-0x1],0x20" 67c643ff20 -a "mov byte ptr [bp+di],0x25" 67c60325 -a "mov byte ptr [bp+di],0x30" 67c60330 -a "mov byte ptr [bp+si-0x1],0x30" 67c642ff30 -a "mov byte ptr [bx],0x0" 67c60700 -a "mov byte ptr [bx+si+0x3e06],0x0" 67c680063e00 -a "mov byte ptr [esi],0x7f" c6067f -a "mov byte ptr [esi],0x86" c60686 -a "mov byte ptr [esp+0x25],0xc0" c6442425c0 -a "mov byte ptr [si],0x11" 67c60411 -a "mov byte ptr [si],0x13" 67c60413 -a "mov byte ptr [si+0x24],0x14" 67c6442414 -a "mov byte ptr [si+0x24],0x18" 67c6442418 -a "mov byte ptr [si+0x24],0x1a" 67c644241a -a "mov byte ptr [si+0x24],0x25" 67c6442425 -a "mov byte ptr [si+0x24],0x2e" 67c644242e -a "mov byte ptr [si+0x24],0x44" 67c6442444 -a "mov byte ptr [si],0x24" 67c60424 -a "mov dword ptr [bx+si+0x6],0x8b640000" 67c740060000648b -a "mov dword ptr [eax+eax*1],0xa740000" c704000000740a -a "mov dword ptr [ebp-0x44],0x31660305" c745bc05036631 -a "mov dword ptr [ebp-0x4c],0x47534943" c745b443495347 -a "mov dword ptr [edx],0x74000000" c70200000074 -a "mov dword ptr [esi],0x15078" c70678500100 -a "mov dword ptr [esi],0x404020" c70620404000 -a "mov dword ptr [esi],0xb0003e04" c706043e00b0 -a "mov dword ptr [esi],0xb8003e04" c706043e00b8 -a "mov dword ptr [esp+0x1c],0x534d4150" c744241c50414d53 -a "mov dword ptr [esp+0x1c],0xc6670001" c744241c010067c6 -a "mov dword ptr [esp],0x1" c7042401000000 -a "mov dword ptr [esp+0x20],0x66670014" c744242014006766 -a "mov dword ptr [esp+0x24],0x66670f00" c7442424000f6766 -a "mov dword ptr [esp+0x24],0x66671a00" c7442424001a6766 -a "mov dword ptr [esp+0x4],0x0" c744240400000000 -a "mov dword ptr [esp+0xc],0x1" c744240c01000000 -a "mov dword ptr [esp+0xc],0x3" c744240c03000000 -a "mov dword ptr [si+0x24],0x6606071c" 67c744241c070666 -a "mov dword ptr [si+0x24],0x660b0c1c" 67c744241c0c0b66 -a "mov dword ptr [si+0x24],0x66111120" 67c7442420111166 -a "mov dword ptr [si+0x24],0x66111220" 67c7442420121166 -a "mov dword ptr [si+0x24],0x66240120" 67c7442420012466 -a "mov dword ptr [si+0x24],0x6700002a" 67c744242a000067 -a "mov dword ptr [si+0x24],0x67000714" 67c7442414070067 -a "mov dword ptr [si+0x24],0x674f0134" 67c7442434014f67 -a "mov dword ptr [si+0x24],0x67e80124" 67c744242401e867 -a "mov dword ptr [si+0x24],0x67e82024" 67c744242420e867 -a "mov word ptr [bp+di+0x10],0x0" 6766c743100000 -a "mov word ptr [bx+si],0x5" 6766c7000500 -a "mov word ptr [esi],0x3d04" 66c706043d -a "mov word ptr [esi],0x4020" 66c7062040 -a "mov word ptr [esi],0x5078" 66c7067850 -a "mov word ptr [esi],0x5084" 66c7068450 -a "mov word ptr [esp+0x10],0x0" 66c74424100000 -a "mov word ptr [esp+0x14],0x0" 66c74424140000 -a "mov word ptr [si+0x24],0x4" 6766c744240400 -a "mov word ptr [si+0x24],0x8" 6766c744240800 -a "mov word ptr [si+0x24],0xff04" 6766c7442404ff -a "mov word ptr [si],0x24" 6766c7042400 -a "mov eax, [eax * 2 + 8]" 8b044508000000 -a "inc al" fec0 -a "inc ax" 6640 -a "inc BYTE PTR [ebx+0x18]" fe4318 -a "inc BYTE PTR [edi+0x18]" fe4718 -a "inc BYTE PTR [esi+0x1a]" fe461a -a "inc cl" fec1 -a "inc dl" fec2 -a "inc DWORD PTR [eax]" ff00 -a "inc DWORD PTR [eax+0x14c]" ff804c010000 -a "inc DWORD PTR [ebp+0x10]" ff4510 -a "inc DWORD PTR [ebx]" ff03 -a "inc DWORD PTR [ebx+0x18]" ff4318 -a "inc DWORD PTR [ebx+0x20]" ff4320 -a "inc DWORD PTR [ecx]" ff01 -a "inc DWORD PTR [ecx+0x4]" ff4104 -a "inc DWORD PTR [edi]" ff07 -a "inc DWORD PTR [edi+0x28]" ff4728 -a "inc DWORD PTR [edx]" ff02 -a "inc DWORD PTR [edx+0x10]" ff4210 -a "inc DWORD PTR [esi+0x8]" ff4608 -a "inc DWORD PTR [esp]" ff0424 -a "inc DWORD PTR [esp+0x10]" ff442410 -a "inc eax" 40 -a "inc ebp" 45 -a "inc ebx" 43 -a "inc ecx" 41 -a "inc edi" 47 -a "inc edx" 42 +a "mov byte ptr [bp+di],0x0" 67c60300 0x0 (storew 0 (+ (+ (cast 32 false (cast 16 false (var ebp))) (* (cast 32 false (cast 16 false (var edi))) (bv 32 0x1))) (bv 32 0x0)) (bv 8 0x0)) +a "mov byte ptr [bp+di-0x1],0x20" 67c643ff20 0x0 (storew 0 (+ (+ (cast 32 false (cast 16 false (var ebp))) (* (cast 32 false (cast 16 false (var edi))) (bv 32 0x1))) (bv 32 0xffffffff)) (bv 8 0x20)) +a "mov byte ptr [bp+di],0x25" 67c60325 0x0 (storew 0 (+ (+ (cast 32 false (cast 16 false (var ebp))) (* (cast 32 false (cast 16 false (var edi))) (bv 32 0x1))) (bv 32 0x0)) (bv 8 0x25)) +a "mov byte ptr [bp+di],0x30" 67c60330 0x0 (storew 0 (+ (+ (cast 32 false (cast 16 false (var ebp))) (* (cast 32 false (cast 16 false (var edi))) (bv 32 0x1))) (bv 32 0x0)) (bv 8 0x30)) +a "mov byte ptr [bp+si-0x1],0x30" 67c642ff30 0x0 (storew 0 (+ (+ (cast 32 false (cast 16 false (var ebp))) (* (cast 32 false (cast 16 false (var esi))) (bv 32 0x1))) (bv 32 0xffffffff)) (bv 8 0x30)) +a "mov byte ptr [bx],0x0" 67c60700 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var ebx))) (bv 32 0x0)) (bv 8 0x0)) +a "mov byte ptr [bx+si+0x3e06],0x0" 67c680063e00 0x0 (storew 0 (+ (+ (cast 32 false (cast 16 false (var ebx))) (* (cast 32 false (cast 16 false (var esi))) (bv 32 0x1))) (bv 32 0x3e06)) (bv 8 0x0)) +a "mov byte ptr [esi],0x7f" c6067f 0x0 (storew 0 (+ (var esi) (bv 32 0x0)) (bv 8 0x7f)) +a "mov byte ptr [esi],0x86" c60686 0x0 (storew 0 (+ (var esi) (bv 32 0x0)) (bv 8 0x86)) +a "mov byte ptr [esp+0x25],0xc0" c6442425c0 0x0 (storew 0 (+ (var esp) (bv 32 0x25)) (bv 8 0xc0)) +a "mov byte ptr [si],0x11" 67c60411 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x0)) (bv 8 0x11)) +a "mov byte ptr [si],0x13" 67c60413 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x0)) (bv 8 0x13)) +a "mov byte ptr [si+0x24],0x14" 67c6442414 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x24)) (bv 8 0x14)) +a "mov byte ptr [si+0x24],0x18" 67c6442418 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x24)) (bv 8 0x18)) +a "mov byte ptr [si+0x24],0x1a" 67c644241a 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x24)) (bv 8 0x1a)) +a "mov byte ptr [si+0x24],0x25" 67c6442425 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x24)) (bv 8 0x25)) +a "mov byte ptr [si+0x24],0x2e" 67c644242e 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x24)) (bv 8 0x2e)) +a "mov byte ptr [si+0x24],0x44" 67c6442444 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x24)) (bv 8 0x44)) +a "mov byte ptr [si],0x24" 67c60424 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x0)) (bv 8 0x24)) +a "mov dword ptr [bx+si+0x6],0x8b640000" 67c740060000648b 0x0 (storew 0 (+ (+ (cast 32 false (cast 16 false (var ebx))) (* (cast 32 false (cast 16 false (var esi))) (bv 32 0x1))) (bv 32 0x6)) (bv 32 0x8b640000)) +a "mov dword ptr [eax+eax*1],0xa740000" c704000000740a 0x0 (storew 0 (+ (+ (var eax) (* (var eax) (bv 32 0x1))) (bv 32 0x0)) (bv 32 0xa740000)) +a "mov dword ptr [ebp-0x44],0x31660305" c745bc05036631 0x0 (storew 0 (+ (var ebp) (bv 32 0xffffffbc)) (bv 32 0x31660305)) +a "mov dword ptr [ebp-0x4c],0x47534943" c745b443495347 0x0 (storew 0 (+ (var ebp) (bv 32 0xffffffb4)) (bv 32 0x47534943)) +a "mov dword ptr [edx],0x74000000" c70200000074 0x0 (storew 0 (+ (var edx) (bv 32 0x0)) (bv 32 0x74000000)) +a "mov dword ptr [esi],0x15078" c70678500100 0x0 (storew 0 (+ (var esi) (bv 32 0x0)) (bv 32 0x15078)) +a "mov dword ptr [esi],0x404020" c70620404000 0x0 (storew 0 (+ (var esi) (bv 32 0x0)) (bv 32 0x404020)) +a "mov dword ptr [esi],0xb0003e04" c706043e00b0 0x0 (storew 0 (+ (var esi) (bv 32 0x0)) (bv 32 0xb0003e04)) +a "mov dword ptr [esi],0xb8003e04" c706043e00b8 0x0 (storew 0 (+ (var esi) (bv 32 0x0)) (bv 32 0xb8003e04)) +a "mov dword ptr [esp+0x1c],0x534d4150" c744241c50414d53 0x0 (storew 0 (+ (var esp) (bv 32 0x1c)) (bv 32 0x534d4150)) +a "mov dword ptr [esp+0x1c],0xc6670001" c744241c010067c6 0x0 (storew 0 (+ (var esp) (bv 32 0x1c)) (bv 32 0xc6670001)) +a "mov dword ptr [esp],0x1" c7042401000000 0x0 (storew 0 (+ (var esp) (bv 32 0x0)) (bv 32 0x1)) +a "mov dword ptr [esp+0x20],0x66670014" c744242014006766 0x0 (storew 0 (+ (var esp) (bv 32 0x20)) (bv 32 0x66670014)) +a "mov dword ptr [esp+0x24],0x66670f00" c7442424000f6766 0x0 (storew 0 (+ (var esp) (bv 32 0x24)) (bv 32 0x66670f00)) +a "mov dword ptr [esp+0x24],0x66671a00" c7442424001a6766 0x0 (storew 0 (+ (var esp) (bv 32 0x24)) (bv 32 0x66671a00)) +a "mov dword ptr [esp+0x4],0x0" c744240400000000 0x0 (storew 0 (+ (var esp) (bv 32 0x4)) (bv 32 0x0)) +a "mov dword ptr [esp+0xc],0x1" c744240c01000000 0x0 (storew 0 (+ (var esp) (bv 32 0xc)) (bv 32 0x1)) +a "mov dword ptr [esp+0xc],0x3" c744240c03000000 0x0 (storew 0 (+ (var esp) (bv 32 0xc)) (bv 32 0x3)) +a "mov dword ptr [si+0x24],0x6606071c" 67c744241c070666 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x24)) (bv 32 0x6606071c)) +a "mov dword ptr [si+0x24],0x660b0c1c" 67c744241c0c0b66 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x24)) (bv 32 0x660b0c1c)) +a "mov dword ptr [si+0x24],0x66111120" 67c7442420111166 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x24)) (bv 32 0x66111120)) +a "mov dword ptr [si+0x24],0x66111220" 67c7442420121166 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x24)) (bv 32 0x66111220)) +a "mov dword ptr [si+0x24],0x66240120" 67c7442420012466 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x24)) (bv 32 0x66240120)) +a "mov dword ptr [si+0x24],0x6700002a" 67c744242a000067 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x24)) (bv 32 0x6700002a)) +a "mov dword ptr [si+0x24],0x67000714" 67c7442414070067 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x24)) (bv 32 0x67000714)) +a "mov dword ptr [si+0x24],0x674f0134" 67c7442434014f67 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x24)) (bv 32 0x674f0134)) +a "mov dword ptr [si+0x24],0x67e80124" 67c744242401e867 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x24)) (bv 32 0x67e80124)) +a "mov dword ptr [si+0x24],0x67e82024" 67c744242420e867 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x24)) (bv 32 0x67e82024)) +a "mov word ptr [bp+di+0x10],0x0" 6766c743100000 0x0 (storew 0 (+ (+ (cast 32 false (cast 16 false (var ebp))) (* (cast 32 false (cast 16 false (var edi))) (bv 32 0x1))) (bv 32 0x10)) (bv 16 0x0)) +a "mov word ptr [bx+si],0x5" 6766c7000500 0x0 (storew 0 (+ (+ (cast 32 false (cast 16 false (var ebx))) (* (cast 32 false (cast 16 false (var esi))) (bv 32 0x1))) (bv 32 0x0)) (bv 16 0x5)) +a "mov word ptr [esi],0x3d04" 66c706043d 0x0 (storew 0 (+ (var esi) (bv 32 0x0)) (bv 16 0x3d04)) +a "mov word ptr [esi],0x4020" 66c7062040 0x0 (storew 0 (+ (var esi) (bv 32 0x0)) (bv 16 0x4020)) +a "mov word ptr [esi],0x5078" 66c7067850 0x0 (storew 0 (+ (var esi) (bv 32 0x0)) (bv 16 0x5078)) +a "mov word ptr [esi],0x5084" 66c7068450 0x0 (storew 0 (+ (var esi) (bv 32 0x0)) (bv 16 0x5084)) +a "mov word ptr [esp+0x10],0x0" 66c74424100000 0x0 (storew 0 (+ (var esp) (bv 32 0x10)) (bv 16 0x0)) +a "mov word ptr [esp+0x14],0x0" 66c74424140000 0x0 (storew 0 (+ (var esp) (bv 32 0x14)) (bv 16 0x0)) +a "mov word ptr [si+0x24],0x4" 6766c744240400 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x24)) (bv 16 0x4)) +a "mov word ptr [si+0x24],0x8" 6766c744240800 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x24)) (bv 16 0x8)) +a "mov word ptr [si+0x24],0xff04" 6766c7442404ff 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x24)) (bv 16 0xff04)) +a "mov word ptr [si],0x24" 6766c7042400 0x0 (storew 0 (+ (cast 32 false (cast 16 false (var esi))) (bv 32 0x0)) (bv 16 0x24)) +a "mov eax, [eax * 2 + 8]" 8b044508000000 0x0 (set eax (loadw 0 32 (+ (* (var eax) (bv 32 0x2)) (bv 32 0x8)))) +a "inc al" fec0 0x0 (seq (set _op (cast 8 false (var eax))) (set _result (+ (var _op) (bv 8 0x1))) (set eax (| (& (var eax) (~ (bv 32 0xff))) (cast 32 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc ax" 6640 0x0 (seq (set _op (cast 16 false (var eax))) (set _result (+ (var _op) (bv 16 0x1))) (set eax (| (& (var eax) (~ (bv 32 0xffff))) (cast 32 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 16 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc BYTE PTR [ebx+0x18]" fe4318 0x0 (seq (set _op (loadw 0 8 (+ (var ebx) (bv 32 0x18)))) (set _result (+ (var _op) (bv 8 0x1))) (storew 0 (+ (var ebx) (bv 32 0x18)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc BYTE PTR [edi+0x18]" fe4718 0x0 (seq (set _op (loadw 0 8 (+ (var edi) (bv 32 0x18)))) (set _result (+ (var _op) (bv 8 0x1))) (storew 0 (+ (var edi) (bv 32 0x18)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc BYTE PTR [esi+0x1a]" fe461a 0x0 (seq (set _op (loadw 0 8 (+ (var esi) (bv 32 0x1a)))) (set _result (+ (var _op) (bv 8 0x1))) (storew 0 (+ (var esi) (bv 32 0x1a)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc cl" fec1 0x0 (seq (set _op (cast 8 false (var ecx))) (set _result (+ (var _op) (bv 8 0x1))) (set ecx (| (& (var ecx) (~ (bv 32 0xff))) (cast 32 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc dl" fec2 0x0 (seq (set _op (cast 8 false (var edx))) (set _result (+ (var _op) (bv 8 0x1))) (set edx (| (& (var edx) (~ (bv 32 0xff))) (cast 32 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [eax]" ff00 0x0 (seq (set _op (loadw 0 32 (+ (var eax) (bv 32 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var eax) (bv 32 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [eax+0x14c]" ff804c010000 0x0 (seq (set _op (loadw 0 32 (+ (var eax) (bv 32 0x14c)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var eax) (bv 32 0x14c)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [ebp+0x10]" ff4510 0x0 (seq (set _op (loadw 0 32 (+ (var ebp) (bv 32 0x10)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var ebp) (bv 32 0x10)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [ebx]" ff03 0x0 (seq (set _op (loadw 0 32 (+ (var ebx) (bv 32 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var ebx) (bv 32 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [ebx+0x18]" ff4318 0x0 (seq (set _op (loadw 0 32 (+ (var ebx) (bv 32 0x18)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var ebx) (bv 32 0x18)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [ebx+0x20]" ff4320 0x0 (seq (set _op (loadw 0 32 (+ (var ebx) (bv 32 0x20)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var ebx) (bv 32 0x20)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [ecx]" ff01 0x0 (seq (set _op (loadw 0 32 (+ (var ecx) (bv 32 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var ecx) (bv 32 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [ecx+0x4]" ff4104 0x0 (seq (set _op (loadw 0 32 (+ (var ecx) (bv 32 0x4)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var ecx) (bv 32 0x4)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [edi]" ff07 0x0 (seq (set _op (loadw 0 32 (+ (var edi) (bv 32 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var edi) (bv 32 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [edi+0x28]" ff4728 0x0 (seq (set _op (loadw 0 32 (+ (var edi) (bv 32 0x28)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var edi) (bv 32 0x28)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [edx]" ff02 0x0 (seq (set _op (loadw 0 32 (+ (var edx) (bv 32 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var edx) (bv 32 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [edx+0x10]" ff4210 0x0 (seq (set _op (loadw 0 32 (+ (var edx) (bv 32 0x10)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var edx) (bv 32 0x10)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [esi+0x8]" ff4608 0x0 (seq (set _op (loadw 0 32 (+ (var esi) (bv 32 0x8)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var esi) (bv 32 0x8)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [esp]" ff0424 0x0 (seq (set _op (loadw 0 32 (+ (var esp) (bv 32 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var esp) (bv 32 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [esp+0x10]" ff442410 0x0 (seq (set _op (loadw 0 32 (+ (var esp) (bv 32 0x10)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var esp) (bv 32 0x10)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc eax" 40 0x0 (seq (set _op (var eax)) (set _result (+ (var _op) (bv 32 0x1))) (set eax (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc ebp" 45 0x0 (seq (set _op (var ebp)) (set _result (+ (var _op) (bv 32 0x1))) (set ebp (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc ebx" 43 0x0 (seq (set _op (var ebx)) (set _result (+ (var _op) (bv 32 0x1))) (set ebx (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc ecx" 41 0x0 (seq (set _op (var ecx)) (set _result (+ (var _op) (bv 32 0x1))) (set ecx (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc edi" 47 0x0 (seq (set _op (var edi)) (set _result (+ (var _op) (bv 32 0x1))) (set edi (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc edx" 42 0x0 (seq (set _op (var edx)) (set _result (+ (var _op) (bv 32 0x1))) (set edx (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) a "dec al" fec8 a "dec ax" 6648 a "dec BYTE PTR [ebx+0x18]" fe4b18 diff --git a/test/db/asm/x86_64 b/test/db/asm/x86_64 index f95a8c2ae3..13cfee0927 100644 --- a/test/db/asm/x86_64 +++ b/test/db/asm/x86_64 @@ -1,982 +1,1025 @@ -a "lea rax, [0x1000]" 488d05f90f0000 -d "lea rax, [rip + 0xff9]" 488d05f90f0000 -ad "nop" 90 -ad "ret" c3 -a "add r13, r15" 4d01fd -a "add r15, rbx" 4901df -a "add rax, 44" 4883c02c -a "add rax, r8" 4c01c0 -a "add r10, r9" 4d01ca -a "add rax, rcx" 4801c8 +a "lea rax, [0x1000]" 488d05f90f0000 0x0 (set rax (+ (bv 64 0x0) (bv 64 0xff9))) +d "lea rax, [rip + 0xff9]" 488d05f90f0000 0x0 (set rax (+ (bv 64 0x0) (bv 64 0xff9))) +ad "leave" c9 0x0 (seq (set rsp (var rbp)) (set rsp (+ (var rsp) (bv 64 0x8))) (set rbp (loadw 0 64 (+ (var rsp) (bv 64 0x0))))) +d "leave" 66c9 0x0 (seq (set rsp (var rbp)) (set rsp (+ (var rsp) (bv 64 0x4))) (set rbp (| (& (var rbp) (~ (bv 64 0xffffffff))) (cast 64 false (loadw 0 32 (+ (var rsp) (bv 64 0x0))))))) +ad "nop" 90 0x0 nop +ad "ret" c3 0x0 (seq (set rsp (+ (var rsp) (bv 64 0x8))) (set rsp (loadw 0 64 (+ (var rsp) (bv 64 0x0))))) +a "add r13, r15" 4d01fd 0x0 (seq (set op1 (var r13)) (set op2 (var r15)) (set sum (+ (var op1) (var op2))) (set r13 (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) +a "add r15, rbx" 4901df 0x0 (seq (set op1 (var r15)) (set op2 (var rbx)) (set sum (+ (var op1) (var op2))) (set r15 (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) +a "add rax, 44" 4883c02c 0x0 (seq (set op1 (var rax)) (set op2 (bv 64 0x2c)) (set sum (+ (var op1) (var op2))) (set rax (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) +a "add rax, r8" 4c01c0 0x0 (seq (set op1 (var rax)) (set op2 (var r8)) (set sum (+ (var op1) (var op2))) (set rax (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) +a "add r10, r9" 4d01ca 0x0 (seq (set op1 (var r10)) (set op2 (var r9)) (set sum (+ (var op1) (var op2))) (set r10 (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) +a "add rax, rcx" 4801c8 0x0 (seq (set op1 (var rax)) (set op2 (var rcx)) (set sum (+ (var op1) (var op2))) (set rax (var sum)) (set _result (var sum)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sum)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (msb (var _x)) (msb (var _y))) (&& (! (msb (var _result))) (msb (var _y)))) (&& (msb (var _x)) (! (msb (var _result)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result)))))))) aB "and dword [ebp + 128], eax" 48218580000000 -a "call rbx" ffd3 -a "cdqe" 4898 -a "cmp rax, 33" 4883f821 -a "cmp rax, rbx" 4839d8 -a "cmp rbx, rax" 4839c3 -a "cmp rdx, rsi" 4839f2 -a "inc rdx" 48ffc2 -a "jmp rbx" ffe3 -a "lea rax, [rax+0]" 488d00 -a "lea rax, [rax+1]" 488d4001 -a "lea rax, [rax-0]" 488d00 -a "lea rax, [rax-1]" 488d40ff -a "lea rax, [rax]" 488d00 +a "call rbx" ffd3 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0)))) +a "cdqe" 4898 0x0 empty +d "cmp qword [rax], 0x21" 48833821 0x0 (seq (set op1 (loadw 0 64 (+ (var rax) (bv 64 0x0)))) (set op2 (bv 64 0x21)) (set sub (- (var op1) (var op2))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "cmp rax, 33" 4883f821 0x0 (seq (set op1 (var rax)) (set op2 (bv 64 0x21)) (set sub (- (var op1) (var op2))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "cmp rax, rbx" 4839d8 0x0 (seq (set op1 (var rax)) (set op2 (var rbx)) (set sub (- (var op1) (var op2))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "cmp rbx, rax" 4839c3 0x0 (seq (set op1 (var rbx)) (set op2 (var rax)) (set sub (- (var op1) (var op2))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "cmp rdx, rsi" 4839f2 0x0 (seq (set op1 (var rdx)) (set op2 (var rsi)) (set sub (- (var op1) (var op2))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "cmpsb" a6 0x0 (seq (set _src1 (loadw 0 8 (var rsi))) (set _src2 (loadw 0 8 (var rdi))) (set _temp (- (var _src1) (var _src2))) (set _result (var _temp)) (set _x (var _src1)) (set _y (var _src2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var _temp)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (branch (var df) (seq (set rsi (- (var rsi) (bv 64 0x1))) (set rdi (- (var rdi) (bv 64 0x1)))) (seq (set rsi (+ (var rsi) (bv 64 0x1))) (set rdi (+ (var rdi) (bv 64 0x1)))))) +a "cmpsd" a7 0x0 (seq (set _src1 (loadw 0 32 (var rsi))) (set _src2 (loadw 0 32 (var rdi))) (set _temp (- (var _src1) (var _src2))) (set _result (var _temp)) (set _x (var _src1)) (set _y (var _src2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var _temp)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (branch (var df) (seq (set rsi (- (var rsi) (bv 64 0x4))) (set rdi (- (var rdi) (bv 64 0x4)))) (seq (set rsi (+ (var rsi) (bv 64 0x4))) (set rdi (+ (var rdi) (bv 64 0x4)))))) +a "cmpsw" 66a7 0x0 (seq (set _src1 (loadw 0 16 (var rsi))) (set _src2 (loadw 0 16 (var rdi))) (set _temp (- (var _src1) (var _src2))) (set _result (var _temp)) (set _x (var _src1)) (set _y (var _src2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var _temp)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (branch (var df) (seq (set rsi (- (var rsi) (bv 64 0x2))) (set rdi (- (var rdi) (bv 64 0x2)))) (seq (set rsi (+ (var rsi) (bv 64 0x2))) (set rdi (+ (var rdi) (bv 64 0x2)))))) +d "cmpsd dword [esi], dword ptr [edi]" 67a7 0x0 (seq (set _src1 (loadw 0 32 (cast 64 false (cast 32 false (var rsi))))) (set _src2 (loadw 0 32 (cast 64 false (cast 32 false (var rdi))))) (set _temp (- (var _src1) (var _src2))) (set _result (var _temp)) (set _x (var _src1)) (set _y (var _src2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var _temp)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (branch (var df) (seq (set rsi (| (& (var rsi) (~ (bv 64 0xffffffff))) (cast 64 false (- (cast 32 false (var rsi)) (bv 32 0x4))))) (set rdi (| (& (var rdi) (~ (bv 64 0xffffffff))) (cast 64 false (- (cast 32 false (var rdi)) (bv 32 0x4)))))) (seq (set rsi (| (& (var rsi) (~ (bv 64 0xffffffff))) (cast 64 false (+ (cast 32 false (var rsi)) (bv 32 0x4))))) (set rdi (| (& (var rdi) (~ (bv 64 0xffffffff))) (cast 64 false (+ (cast 32 false (var rdi)) (bv 32 0x4)))))))) +d "cmpsq qword [rsi], qword ptr [rdi]" 48a7 0x0 (seq (set _src1 (loadw 0 64 (var rsi))) (set _src2 (loadw 0 64 (var rdi))) (set _temp (- (var _src1) (var _src2))) (set _result (var _temp)) (set _x (var _src1)) (set _y (var _src2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var _temp)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (branch (var df) (seq (set rsi (- (var rsi) (bv 64 0x8))) (set rdi (- (var rdi) (bv 64 0x8)))) (seq (set rsi (+ (var rsi) (bv 64 0x8))) (set rdi (+ (var rdi) (bv 64 0x8)))))) +a "lodsb" ac 0x0 (seq (set rax (| (& (var rax) (~ (bv 64 0xff))) (cast 64 false (loadw 0 8 (var rsi))))) (branch (var df) (set rsi (- (var rsi) (bv 64 0x1))) (set rsi (+ (var rsi) (bv 64 0x1))))) +a "lodsd" ad 0x0 (seq (set rax (| (& (var rax) (~ (bv 64 0xffffffff))) (cast 64 false (loadw 0 32 (var rsi))))) (branch (var df) (set rsi (- (var rsi) (bv 64 0x4))) (set rsi (+ (var rsi) (bv 64 0x4))))) +a "lodsw" 66ad 0x0 (seq (set rax (| (& (var rax) (~ (bv 64 0xffff))) (cast 64 false (loadw 0 16 (var rsi))))) (branch (var df) (set rsi (- (var rsi) (bv 64 0x2))) (set rsi (+ (var rsi) (bv 64 0x2))))) +d "lodsd eax, dword [esi]" 67ad 0x0 (seq (set rax (| (& (var rax) (~ (bv 64 0xffffffff))) (cast 64 false (loadw 0 32 (cast 64 false (cast 32 false (var rsi))))))) (branch (var df) (set rsi (| (& (var rsi) (~ (bv 64 0xffffffff))) (cast 64 false (- (cast 32 false (var rsi)) (bv 32 0x4))))) (set rsi (| (& (var rsi) (~ (bv 64 0xffffffff))) (cast 64 false (+ (cast 32 false (var rsi)) (bv 32 0x4))))))) +d "lodsq rax, qword [rsi]" 48ad 0x0 (seq (set rax (loadw 0 64 (var rsi))) (branch (var df) (set rsi (- (var rsi) (bv 64 0x8))) (set rsi (+ (var rsi) (bv 64 0x8))))) +d "loop 0" 67e2fd 0x0 (seq (set rcx (| (& (var rcx) (~ (bv 64 0xffffffff))) (cast 64 false (- (cast 32 false (var rcx)) (bv 32 0x1))))) (branch (! (is_zero (cast 32 false (var rcx)))) (jmp (bv 64 0x0)) nop)) +a "movsb" a4 0x0 (seq (storew 0 (var rdi) (loadw 0 8 (var rsi))) (branch (var df) (seq (set rsi (- (var rsi) (bv 64 0x1))) (set rdi (- (var rdi) (bv 64 0x1)))) (seq (set rsi (+ (var rsi) (bv 64 0x1))) (set rdi (+ (var rdi) (bv 64 0x1)))))) +a "movsd" a5 0x0 (seq (storew 0 (var rdi) (loadw 0 32 (var rsi))) (branch (var df) (seq (set rsi (- (var rsi) (bv 64 0x4))) (set rdi (- (var rdi) (bv 64 0x4)))) (seq (set rsi (+ (var rsi) (bv 64 0x4))) (set rdi (+ (var rdi) (bv 64 0x4)))))) +a "movsw" 66a5 0x0 (seq (storew 0 (var rdi) (loadw 0 16 (var rsi))) (branch (var df) (seq (set rsi (- (var rsi) (bv 64 0x2))) (set rdi (- (var rdi) (bv 64 0x2)))) (seq (set rsi (+ (var rsi) (bv 64 0x2))) (set rdi (+ (var rdi) (bv 64 0x2)))))) +d "movsd dword [edi], dword ptr [esi]" 67a5 0x0 (seq (storew 0 (cast 64 false (cast 32 false (var rdi))) (loadw 0 32 (cast 64 false (cast 32 false (var rsi))))) (branch (var df) (seq (set rsi (| (& (var rsi) (~ (bv 64 0xffffffff))) (cast 64 false (- (cast 32 false (var rsi)) (bv 32 0x4))))) (set rdi (| (& (var rdi) (~ (bv 64 0xffffffff))) (cast 64 false (- (cast 32 false (var rdi)) (bv 32 0x4)))))) (seq (set rsi (| (& (var rsi) (~ (bv 64 0xffffffff))) (cast 64 false (+ (cast 32 false (var rsi)) (bv 32 0x4))))) (set rdi (| (& (var rdi) (~ (bv 64 0xffffffff))) (cast 64 false (+ (cast 32 false (var rdi)) (bv 32 0x4)))))))) +d "movsq qword [rdi], qword ptr [rsi]" 48a5 0x0 (seq (storew 0 (var rdi) (loadw 0 64 (var rsi))) (branch (var df) (seq (set rsi (- (var rsi) (bv 64 0x8))) (set rdi (- (var rdi) (bv 64 0x8)))) (seq (set rsi (+ (var rsi) (bv 64 0x8))) (set rdi (+ (var rdi) (bv 64 0x8)))))) +a "stosb" aa 0x0 (seq (storew 0 (var rdi) (cast 8 false (var rax))) (branch (var df) (set rdi (- (var rdi) (bv 64 0x1))) (set rdi (+ (var rdi) (bv 64 0x1))))) +a "stosd" ab 0x0 (seq (storew 0 (var rdi) (cast 32 false (var rax))) (branch (var df) (set rdi (- (var rdi) (bv 64 0x4))) (set rdi (+ (var rdi) (bv 64 0x4))))) +a "stosw" 66ab 0x0 (seq (storew 0 (var rdi) (cast 16 false (var rax))) (branch (var df) (set rdi (- (var rdi) (bv 64 0x2))) (set rdi (+ (var rdi) (bv 64 0x2))))) +d "stosd dword [edi], eax" 67ab 0x0 (seq (storew 0 (cast 64 false (cast 32 false (var rdi))) (cast 32 false (var rax))) (branch (var df) (set rdi (| (& (var rdi) (~ (bv 64 0xffffffff))) (cast 64 false (- (cast 32 false (var rdi)) (bv 32 0x4))))) (set rdi (| (& (var rdi) (~ (bv 64 0xffffffff))) (cast 64 false (+ (cast 32 false (var rdi)) (bv 32 0x4))))))) +d "stosq qword [rdi], rax" 48ab 0x0 (seq (storew 0 (var rdi) (var rax)) (branch (var df) (set rdi (- (var rdi) (bv 64 0x8))) (set rdi (+ (var rdi) (bv 64 0x8))))) +a "scasb" ae 0x0 (seq (set _reg (cast 8 false (var rax))) (set _src (loadw 0 8 (var rdi))) (set _temp (- (var _reg) (var _src))) (set _result (var _temp)) (set _x (var _reg)) (set _y (var _src)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var _temp)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (branch (var df) (set rdi (- (var rdi) (bv 64 0x1))) (set rdi (+ (var rdi) (bv 64 0x1))))) +a "scasd" af 0x0 (seq (set _reg (cast 32 false (var rax))) (set _src (loadw 0 32 (var rdi))) (set _temp (- (var _reg) (var _src))) (set _result (var _temp)) (set _x (var _reg)) (set _y (var _src)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var _temp)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (branch (var df) (set rdi (- (var rdi) (bv 64 0x4))) (set rdi (+ (var rdi) (bv 64 0x4))))) +a "scasw" 66af 0x0 (seq (set _reg (cast 16 false (var rax))) (set _src (loadw 0 16 (var rdi))) (set _temp (- (var _reg) (var _src))) (set _result (var _temp)) (set _x (var _reg)) (set _y (var _src)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var _temp)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (branch (var df) (set rdi (- (var rdi) (bv 64 0x2))) (set rdi (+ (var rdi) (bv 64 0x2))))) +d "scasd eax, dword [edi]" 67af 0x0 (seq (set _reg (cast 32 false (var rax))) (set _src (loadw 0 32 (cast 64 false (cast 32 false (var rdi))))) (set _temp (- (var _reg) (var _src))) (set _result (var _temp)) (set _x (var _reg)) (set _y (var _src)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var _temp)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (branch (var df) (set rdi (| (& (var rdi) (~ (bv 64 0xffffffff))) (cast 64 false (- (cast 32 false (var rdi)) (bv 32 0x4))))) (set rdi (| (& (var rdi) (~ (bv 64 0xffffffff))) (cast 64 false (+ (cast 32 false (var rdi)) (bv 32 0x4))))))) +d "scasq rax, qword [rdi]" 48af 0x0 (seq (set _reg (var rax)) (set _src (loadw 0 64 (var rdi))) (set _temp (- (var _reg) (var _src))) (set _result (var _temp)) (set _x (var _reg)) (set _y (var _src)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x))))))) (set _result (var _temp)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (branch (var df) (set rdi (- (var rdi) (bv 64 0x8))) (set rdi (+ (var rdi) (bv 64 0x8))))) +ad "mul rax" 48f7e0 0x0 (seq (set _mul (* (cast 128 false (var rax)) (cast 128 false (var rax)))) (set rdx (cast 64 false (>> (var _mul) (bv 8 0x40) false))) (set rax (cast 64 false (var _mul))) (branch (is_zero (>> (var _mul) (bv 8 0x40) false)) (seq (set of false) (set cf false)) (seq (set of true) (set cf true)))) +ad "div rax" 48f7f0 0x0 (seq (set _src (cast 128 false (var rax))) (branch (is_zero (var _src)) nop (seq (set _rdxrax (| (<< (cast 128 false (var rdx)) (bv 8 0x40) false) (cast 128 false (var rax)))) (set _temp (cast 64 false (div (var _rdxrax) (var _src)))) (branch (! (ule (var _temp) (bv 64 0xffffffffffffffff))) nop (seq (set rax (| (& (var rax) (~ (bv 64 0xffff))) (cast 64 false (var _temp)))) (set rdx (| (& (var rdx) (~ (bv 64 0xffff))) (cast 64 false (mod (var _rdxrax) (var _src)))))))))) +ad "idiv rax" 48f7f8 0x0 (seq (set _src (cast 128 false (var rax))) (branch (is_zero (var _src)) nop (seq (set _rdxrax (| (<< (cast 128 false (cast 32 false (var rdx))) (bv 8 0x40) false) (cast 128 false (cast 32 false (var rax))))) (set _temp (cast 64 false (sdiv (var _rdxrax) (var _src)))) (branch (|| (! (sle (var _temp) (bv 64 0x7fffffffffffffff))) (&& (sle (var _temp) (bv 64 0x8000000000000000)) (! (== (var _temp) (bv 64 0x8000000000000000))))) nop (seq (set rax (| (& (var rax) (~ (bv 64 0xffff))) (cast 64 false (var _temp)))) (set rdx (| (& (var rdx) (~ (bv 64 0xffff))) (cast 64 false (smod (var _rdxrax) (var _src)))))))))) +ad "imul rax" 48f7e8 0x0 (seq (set _tmp_xp (* (cast 128 (msb (var rax)) (var rax)) (cast 128 (msb (var rax)) (var rax)))) (set rax (cast 64 false (var _tmp_xp))) (set rdx (cast 64 false (>> (var _tmp_xp) (bv 8 0x40) false))) (branch (== (cast 128 (msb (cast 64 false (var _tmp_xp))) (cast 64 false (var _tmp_xp))) (var _tmp_xp)) (seq (set cf false) (set of false)) (seq (set cf true) (set of true)))) +a "inc rdx" 48ffc2 0x0 (seq (set _op (var rdx)) (set _result (+ (var _op) (bv 64 0x1))) (set rdx (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +d "jrcxz 0x39" e303 0x34 (branch (is_zero (var rcx)) (jmp (+ (bv 64 0x34) (bv 64 0x39))) nop) +d "jecxz 0x4a" 67e303 0x44 (branch (is_zero (cast 32 false (var rcx))) (jmp (+ (bv 64 0x44) (bv 64 0x4a))) nop) +a "jmp rbx" ffe3 0x0 (jmp (cast 64 false (var rbx))) +a "lea rax, [rax+0]" 488d00 0x0 (set rax (+ (var rax) (bv 64 0x0))) +a "lea rax, [rax+1]" 488d4001 0x0 (set rax (+ (var rax) (bv 64 0x1))) +a "lea rax, [rax-0]" 488d00 0x0 (set rax (+ (var rax) (bv 64 0x0))) +a "lea rax, [rax-1]" 488d40ff 0x0 (set rax (+ (var rax) (bv 64 0xffffffffffffffff))) +a "lea rax, [rax]" 488d00 0x0 (set rax (+ (var rax) (bv 64 0x0))) +d "lea eax, [rax]" 8d00 0x0 (set rax (| (& (var rax) (~ (bv 64 0xffffffff))) (cast 64 false (+ (var rax) (bv 64 0x0))))) +d "lea rax, [eax]" 67488d00 0x0 (set rax (+ (cast 64 false (cast 32 false (var rax))) (bv 64 0x0))) aB "lea rax,[rel -10]" 488d06f6ffffff aB "lea rax,[rel 0]" 488d0500000000 aB "lea rax,[rel 10]" 488d050a000000 -a "lea rax,[rip+0]" 488d0500000000 -a "lea rax,[rip+10]" 488d050a000000 -a "lea rax,[rip-0]" 488d0500000000 -a "lea rax,[rip-10]" 488d05f6ffffff -a "lea rax,[rip]" 488d0500000000 -a "lea rdi,[rip+0x1011]" 488d3d11100000 +a "lea rax,[rip+0]" 488d0500000000 0x0 (set rax (+ (bv 64 0x0) (bv 64 0x0))) +a "lea rax,[rip+10]" 488d050a000000 0x0 (set rax (+ (bv 64 0x0) (bv 64 0xa))) +a "lea rax,[rip-0]" 488d0500000000 0x0 (set rax (+ (bv 64 0x0) (bv 64 0x0))) +a "lea rax,[rip-10]" 488d05f6ffffff 0x0 (set rax (+ (bv 64 0x0) (bv 64 0xfffffffffffffff6))) +a "lea rax,[rip]" 488d0500000000 0x0 (set rax (+ (bv 64 0x0) (bv 64 0x0))) +a "lea rdi,[rip+0x1011]" 488d3d11100000 0x0 (set rdi (+ (bv 64 0x0) (bv 64 0x1011))) aB "lea rax, [0x803]" 488d042503080000 aB "lea rax, 0x803" 488d042503080000 -a "mov [rsi], rbx" 48891e -ad "mov eax, 0" b800000000 -ad "mov ecx, 0x7fffffff" b9ffffff7f -a "mov esi, -0x80000000" be00000080 -ad "mov esi, 0x80000000" be00000080 -a "mov edi, -1" bfffffffff -ad "mov edi, 0xffffffff" bfffffffff -a "mov rax, 0x1122334455667788" 48b88877665544332211 -a "mov rax, 3" 48c7c003000000 -a "mov rax, 33" 48c7c021000000 -ad "mov rax, 0x7fffffff" 48c7c0ffffff7f -a "mov rax, 0x80000000" 48b80000008000000000 -ad "movabs rax, 0x80000000" 48b80000008000000000 -a "mov rax, 0xdeadbeef" 48b8efbeadde00000000 -ad "movabs rax, 0xdeadbeef" 48b8efbeadde00000000 -a "mov rax, 0xffffffff" 48b8ffffffff00000000 -ad "movabs rax, 0xffffffff" 48b8ffffffff00000000 -a "mov rax, 0x100000000" 48b80000000001000000 -ad "movabs rax, 0x100000000" 48b80000000001000000 -ad "mov rax, 0" 48c7c000000000 -a "mov rax, -1" 48c7c0ffffffff -a "mov rax, -0x1" 48c7c0ffffffff -ad "mov rax, 0xffffffffffffffff" 48c7c0ffffffff -a "mov rax, 0xFfFFffFFFFffffff" 48c7c0ffffffff -a "mov rax, -1U" 48c7c0ffffffff -a "mov rax, 0xffffffffffffffffU" 48c7c0ffffffff -a "mov rax, -2" 48c7c0feffffff -ad "mov rax, 0xfffffffffffffffe" 48c7c0feffffff -a "mov rax, -0x80000000" 48c7c000000080 -ad "mov rax, 0xffffffff80000000" 48c7c000000080 -a "mov rax, -0x80000001" 48b8ffffff7fffffffff -ad "movabs rax, 0xffffffff7fffffff" 48b8ffffff7fffffffff -ad "mov r9, 0x7fffffff" 49c7c1ffffff7f -a "mov r10, 0x80000000" 49ba0000008000000000 -ad "movabs r10, 0x80000000" 49ba0000008000000000 -a "mov r11, 0x100000000" 49bb0000000001000000 -ad "movabs r11, 0x100000000" 49bb0000000001000000 -a "mov r14, -0x80000000" 49c7c600000080 -ad "mov r14, 0xffffffff80000000" 49c7c600000080 -a "mov r15, -0x80000001" 49bfffffff7fffffffff -ad "movabs r15, 0xffffffff7fffffff" 49bfffffff7fffffffff -a "mov rax, [rax+0]" 488b00 -a "mov rax, [rax+1]" 488b4001 -a "mov rax, [rax-0]" 488b00 -a "mov rax, [rax-1]" 488b40ff -a "mov rax, [rax]" 488b00 +a "mov [rsi], rbx" 48891e 0x0 (storew 0 (+ (var rsi) (bv 64 0x0)) (var rbx)) +ad "mov eax, 0" b800000000 0x0 (set rax (| (& (var rax) (~ (bv 64 0xffffffff))) (cast 64 false (bv 32 0x0)))) +ad "mov ecx, 0x7fffffff" b9ffffff7f 0x0 (set rcx (| (& (var rcx) (~ (bv 64 0xffffffff))) (cast 64 false (bv 32 0x7fffffff)))) +a "mov esi, -0x80000000" be00000080 0x0 (set rsi (| (& (var rsi) (~ (bv 64 0xffffffff))) (cast 64 false (bv 32 0x80000000)))) +ad "mov esi, 0x80000000" be00000080 0x0 (set rsi (| (& (var rsi) (~ (bv 64 0xffffffff))) (cast 64 false (bv 32 0x80000000)))) +a "mov edi, -1" bfffffffff 0x0 (set rdi (| (& (var rdi) (~ (bv 64 0xffffffff))) (cast 64 false (bv 32 0xffffffff)))) +ad "mov edi, 0xffffffff" bfffffffff 0x0 (set rdi (| (& (var rdi) (~ (bv 64 0xffffffff))) (cast 64 false (bv 32 0xffffffff)))) +a "mov rax, 0x1122334455667788" 48b88877665544332211 0x0 empty +a "mov rax, 3" 48c7c003000000 0x0 (set rax (bv 64 0x3)) +a "mov rax, 33" 48c7c021000000 0x0 (set rax (bv 64 0x21)) +ad "mov rax, 0x7fffffff" 48c7c0ffffff7f 0x0 (set rax (bv 64 0x7fffffff)) +a "mov rax, 0x80000000" 48b80000008000000000 0x0 empty +ad "movabs rax, 0x80000000" 48b80000008000000000 0x0 empty +a "mov rax, 0xdeadbeef" 48b8efbeadde00000000 0x0 empty +ad "movabs rax, 0xdeadbeef" 48b8efbeadde00000000 0x0 empty +a "mov rax, 0xffffffff" 48b8ffffffff00000000 0x0 empty +ad "movabs rax, 0xffffffff" 48b8ffffffff00000000 0x0 empty +a "mov rax, 0x100000000" 48b80000000001000000 0x0 empty +ad "movabs rax, 0x100000000" 48b80000000001000000 0x0 empty +ad "mov rax, 0" 48c7c000000000 0x0 (set rax (bv 64 0x0)) +a "mov rax, -1" 48c7c0ffffffff 0x0 (set rax (bv 64 0xffffffffffffffff)) +a "mov rax, -0x1" 48c7c0ffffffff 0x0 (set rax (bv 64 0xffffffffffffffff)) +ad "mov rax, 0xffffffffffffffff" 48c7c0ffffffff 0x0 (set rax (bv 64 0xffffffffffffffff)) +a "mov rax, 0xFfFFffFFFFffffff" 48c7c0ffffffff 0x0 (set rax (bv 64 0xffffffffffffffff)) +a "mov rax, -1U" 48c7c0ffffffff 0x0 (set rax (bv 64 0xffffffffffffffff)) +a "mov rax, 0xffffffffffffffffU" 48c7c0ffffffff 0x0 (set rax (bv 64 0xffffffffffffffff)) +a "mov rax, -2" 48c7c0feffffff 0x0 (set rax (bv 64 0xfffffffffffffffe)) +ad "mov rax, 0xfffffffffffffffe" 48c7c0feffffff 0x0 (set rax (bv 64 0xfffffffffffffffe)) +a "mov rax, -0x80000000" 48c7c000000080 0x0 (set rax (bv 64 0xffffffff80000000)) +ad "mov rax, 0xffffffff80000000" 48c7c000000080 0x0 (set rax (bv 64 0xffffffff80000000)) +a "mov rax, -0x80000001" 48b8ffffff7fffffffff 0x0 empty +ad "movabs rax, 0xffffffff7fffffff" 48b8ffffff7fffffffff 0x0 empty +ad "mov r9, 0x7fffffff" 49c7c1ffffff7f 0x0 (set r9 (bv 64 0x7fffffff)) +a "mov r10, 0x80000000" 49ba0000008000000000 0x0 empty +ad "movabs r10, 0x80000000" 49ba0000008000000000 0x0 empty +a "mov r11, 0x100000000" 49bb0000000001000000 0x0 empty +ad "movabs r11, 0x100000000" 49bb0000000001000000 0x0 empty +a "mov r14, -0x80000000" 49c7c600000080 0x0 (set r14 (bv 64 0xffffffff80000000)) +ad "mov r14, 0xffffffff80000000" 49c7c600000080 0x0 (set r14 (bv 64 0xffffffff80000000)) +a "mov r15, -0x80000001" 49bfffffff7fffffffff 0x0 empty +ad "movabs r15, 0xffffffff7fffffff" 49bfffffff7fffffffff 0x0 empty +a "mov rax, [rax+0]" 488b00 0x0 (set rax (loadw 0 64 (+ (var rax) (bv 64 0x0)))) +a "mov rax, [rax+1]" 488b4001 0x0 (set rax (loadw 0 64 (+ (var rax) (bv 64 0x1)))) +a "mov rax, [rax-0]" 488b00 0x0 (set rax (loadw 0 64 (+ (var rax) (bv 64 0x0)))) +a "mov rax, [rax-1]" 488b40ff 0x0 (set rax (loadw 0 64 (+ (var rax) (bv 64 0xffffffffffffffff)))) +a "mov rax, [rax]" 488b00 0x0 (set rax (loadw 0 64 (+ (var rax) (bv 64 0x0)))) aB "mov rax,[rel -10]" 488b05f6ffffff aB "mov rax,[rel 0]" 488b0500000000 aB "mov rax,[rel 10]" 488b050a000000 -a "mov rax,[rip+0]" 488b0500000000 -a "mov rax,[rip+10]" 488b050a000000 -a "mov rax,[rip-0]" 488b0500000000 -a "mov rax,[rip-10]" 488b05f6ffffff -a "mov rax,[rip]" 488b0500000000 -a "mov rbx, 3" 48c7c303000000 -a "mov edx, [rbp-4]" 8b55fc -a "mov rbx, rax" 4889c3 -a "mov rcx, -0x1122334455667788" 48b9788899aabbccddee +a "mov rax,[rip+0]" 488b0500000000 0x0 (set rax (loadw 0 64 (+ (bv 64 0x0) (bv 64 0x0)))) +a "mov rax,[rip+10]" 488b050a000000 0x0 (set rax (loadw 0 64 (+ (bv 64 0x0) (bv 64 0xa)))) +a "mov rax,[rip-0]" 488b0500000000 0x0 (set rax (loadw 0 64 (+ (bv 64 0x0) (bv 64 0x0)))) +a "mov rax,[rip-10]" 488b05f6ffffff 0x0 (set rax (loadw 0 64 (+ (bv 64 0x0) (bv 64 0xfffffffffffffff6)))) +a "mov rax,[rip]" 488b0500000000 0x0 (set rax (loadw 0 64 (+ (bv 64 0x0) (bv 64 0x0)))) +a "mov rbx, 3" 48c7c303000000 0x0 (set rbx (bv 64 0x3)) +a "mov edx, [rbp-4]" 8b55fc 0x0 (set rdx (| (& (var rdx) (~ (bv 64 0xffffffff))) (cast 64 false (loadw 0 32 (+ (var rbp) (bv 64 0xfffffffffffffffc)))))) +a "mov rbx, rax" 4889c3 0x0 (set rbx (var rax)) +a "mov rcx, -0x1122334455667788" 48b9788899aabbccddee 0x0 empty aB "mov rcx, -0x112233445566778899" 00 -a "mov rsi, rbx" 4889de -a "mov rcx, r9" 4c89c9 -a "mov r10, rax" 4989c2 -a "mov r12, r9" 4d89cc -a "mov rcx, rbp" 4889e9 -a "mov al, [0xbeef]" a0efbe000000000000 -a "mov ax, [0xbeef]" 66a1efbe000000000000 -a "mov eax, [0xbeef]" a1efbe000000000000 -a "mov rax, [0xbeef]" 48a1efbe000000000000 -a "mov rax, [0x1122334455667788]" 48a18877665544332211 -a "mov rax, [rax + 0xbeef]" 488b80efbe0000 -a "mov rax, [rbx + 0xbeef]" 488b83efbe0000 -a "mov rcx, [rbx + 0xbeef]" 488b8befbe0000 -a "mov rbx, [rbp + 0xbeef]" 488b9defbe0000 -a "mov rax, [rip + 0xbeef]" 488b05efbe0000 +a "mov rsi, rbx" 4889de 0x0 (set rsi (var rbx)) +a "mov rcx, r9" 4c89c9 0x0 (set rcx (var r9)) +a "mov r10, rax" 4989c2 0x0 (set r10 (var rax)) +a "mov r12, r9" 4d89cc 0x0 (set r12 (var r9)) +a "mov rcx, rbp" 4889e9 0x0 (set rcx (var rbp)) +a "mov al, [0xbeef]" a0efbe000000000000 0x0 empty +a "mov ax, [0xbeef]" 66a1efbe000000000000 0x0 empty +a "mov eax, [0xbeef]" a1efbe000000000000 0x0 empty +a "mov rax, [0xbeef]" 48a1efbe000000000000 0x0 empty +a "mov rax, [0x1122334455667788]" 48a18877665544332211 0x0 empty +a "mov rax, [rax + 0xbeef]" 488b80efbe0000 0x0 (set rax (loadw 0 64 (+ (var rax) (bv 64 0xbeef)))) +a "mov rax, [rbx + 0xbeef]" 488b83efbe0000 0x0 (set rax (loadw 0 64 (+ (var rbx) (bv 64 0xbeef)))) +a "mov rcx, [rbx + 0xbeef]" 488b8befbe0000 0x0 (set rcx (loadw 0 64 (+ (var rbx) (bv 64 0xbeef)))) +a "mov rbx, [rbp + 0xbeef]" 488b9defbe0000 0x0 (set rbx (loadw 0 64 (+ (var rbp) (bv 64 0xbeef)))) +a "mov rax, [rip + 0xbeef]" 488b05efbe0000 0x0 (set rax (loadw 0 64 (+ (bv 64 0x0) (bv 64 0xbeef)))) +a "mov qword [rax], 0x0" 48c70000000000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 64 0x0)) aB "mov sil, 0" 40b600 aB "mov dil, -5" 40b7fb aB "mov spl, bpl" 4088ec -a "pop rax" 58 -ad "pop r8" 4158 -ad "pop r15" 415f +a "pop rax" 58 0x0 (seq (set rax (loadw 0 64 (+ (var rsp) (bv 64 0x0)))) (set rsp (+ (var rsp) (bv 64 0x8)))) +ad "pop r8" 4158 0x0 (seq (set r8 (loadw 0 64 (+ (var rsp) (bv 64 0x0)))) (set rsp (+ (var rsp) (bv 64 0x8)))) +ad "pop r15" 415f 0x0 (seq (set r15 (loadw 0 64 (+ (var rsp) (bv 64 0x0)))) (set rsp (+ (var rsp) (bv 64 0x8)))) +d "popfq" 9d 0x0 (seq (set _flags (loadw 0 64 (+ (var rsp) (bv 64 0x0)))) (set cf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set pf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set af (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x2) false)) (set zf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set sf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set tf (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set if (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set df (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x1) false)) (set of (lsb (var _flags))) (set _flags (>> (var _flags) (bv 8 0x3) false)) (set nt (lsb (var _flags))) (set rsp (+ (var rsp) (bv 64 0x8)))) +d "pushfq" 9c 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (| (<< (ite false (bv 64 0x1) (bv 64 0x0)) (bv 64 0x1) false) (ite (var nt) (bv 64 0x1) (bv 64 0x0))) (bv 64 0x2) false) (bv 64 0x3)) (bv 64 0x1) false) (ite (var of) (bv 64 0x1) (bv 64 0x0))) (bv 64 0x1) false) (ite (var df) (bv 64 0x1) (bv 64 0x0))) (bv 64 0x1) false) (ite (var if) (bv 64 0x1) (bv 64 0x0))) (bv 64 0x1) false) (ite (var tf) (bv 64 0x1) (bv 64 0x0))) (bv 64 0x1) false) (ite (var zf) (bv 64 0x1) (bv 64 0x0))) (bv 64 0x1) false) (ite (var zf) (bv 64 0x1) (bv 64 0x0))) (bv 64 0x2) false) (ite (var af) (bv 64 0x1) (bv 64 0x0))) (bv 64 0x2) false) (ite (var pf) (bv 64 0x1) (bv 64 0x0))) (bv 64 0x1) false) (bv 64 0x1)) (bv 64 0x1) false) (ite (var cf) (bv 64 0x1) (bv 64 0x0)))))) aB "prefetcht1 [eax]" 670f1810 aB "prefetcht1 [rax]" 0f1810 aB "prefetcht1 byte [eax]" 670f1810 aB "prefetcht1 byte [rax]" 0f1810 -a "shl rdx, 5" 48c1e205 -a "sub rax, 44" 4883e82c -a "sub rax, rbx" 4829d8 -a "sub r9, rbx" 4929d9 -a "sub rcx, r10" 4c29d1 -a "sub r12, r11" 4d29dc -a "test ebx, 0x12345678" f7c378563412 -a "test rbx, 0x12345678" 48f7c378563412 -a "test dword [eax], 0x12345678" 67f70078563412 -a "test dword [rax], 0x12345678" f70078563412 -a "test qword [rcx], 0x12345678" 48f70178563412 -a "test rax, rbx" 4885d8 -a "test rcx, rcx" 4885c9 -a "test rdx, rsi" 4885f2 -a "test r8, r8" 4d85c0 -a "xor [rax], rax" 483100 -a "xor [rsi], rbx" 48311e -a "xor rax, rax" 4831c0 -a "xor rdx, rdx" 4831d2 +a "shl rdx, 5" 48c1e205 0x0 (seq (set _cnt (bv 8 0x5)) (set _cnt_mask (bv 8 0x3f)) (set _masked (& (var _cnt) (var _cnt_mask))) (set _tmp_cnt (var _masked)) (set _dest (var rdx)) (set _tmp_dest (var _dest)) (repeat (! (is_zero (var _tmp_cnt))) (seq (set cf (msb (var _dest))) (set _dest (<< (var _dest) (bv 8 0x1) false)) (set _tmp_cnt (- (var _tmp_cnt) (bv 8 0x1))))) (branch (== (var _masked) (bv 8 0x1)) (set of (^^ (msb (var _dest)) (var cf))) nop)) +a "sub rax, 44" 4883e82c 0x0 (seq (set op1 (var rax)) (set op2 (bv 64 0x2c)) (set sub (- (var op1) (var op2))) (set rax (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub rax, rbx" 4829d8 0x0 (seq (set op1 (var rax)) (set op2 (var rbx)) (set sub (- (var op1) (var op2))) (set rax (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub r9, rbx" 4929d9 0x0 (seq (set op1 (var r9)) (set op2 (var rbx)) (set sub (- (var op1) (var op2))) (set r9 (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub rcx, r10" 4c29d1 0x0 (seq (set op1 (var rcx)) (set op2 (var r10)) (set sub (- (var op1) (var op2))) (set rcx (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "sub r12, r11" 4d29dc 0x0 (seq (set op1 (var r12)) (set op2 (var r11)) (set sub (- (var op1) (var op2))) (set r12 (var sub)) (set _result (var sub)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var sub)) (set _x (var op1)) (set _y (var op2)) (set cf (|| (|| (&& (! (msb (var _x))) (msb (var _y))) (&& (msb (var _y)) (msb (var _result)))) (&& (msb (var _result)) (! (msb (var _x)))))) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "test ebx, 0x12345678" f7c378563412 0x0 (seq (set _res (& (cast 32 false (var rbx)) (bv 32 0x12345678))) (set rbx (| (& (var rbx) (~ (bv 64 0xffffffff))) (cast 64 false (var _res)))) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +a "test rbx, 0x12345678" 48f7c378563412 0x0 (seq (set _res (& (var rbx) (bv 64 0x12345678))) (set rbx (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +a "test dword [eax], 0x12345678" 67f70078563412 0x0 (seq (set _res (& (loadw 0 32 (+ (cast 64 false (cast 32 false (var rax))) (bv 64 0x0))) (bv 32 0x12345678))) (storew 0 (+ (cast 64 false (cast 32 false (var rax))) (bv 64 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +a "test dword [rax], 0x12345678" f70078563412 0x0 (seq (set _res (& (loadw 0 32 (+ (var rax) (bv 64 0x0))) (bv 32 0x12345678))) (storew 0 (+ (var rax) (bv 64 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +a "test qword [rcx], 0x12345678" 48f70178563412 0x0 (seq (set _res (& (loadw 0 64 (+ (var rcx) (bv 64 0x0))) (bv 64 0x12345678))) (storew 0 (+ (var rcx) (bv 64 0x0)) (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +a "test rax, rbx" 4885d8 0x0 (seq (set _res (& (var rax) (var rbx))) (set rax (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +a "test rcx, rcx" 4885c9 0x0 (seq (set _res (& (var rcx) (var rcx))) (set rcx (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +a "test rdx, rsi" 4885f2 0x0 (seq (set _res (& (var rdx) (var rsi))) (set rdx (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +a "test r8, r8" 4d85c0 0x0 (seq (set _res (& (var r8) (var r8))) (set r8 (var _res)) (set _result (var _res)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set cf false) (set of false)) +a "xor [rax], rax" 483100 0x0 (seq (set _xor (^ (loadw 0 64 (+ (var rax) (bv 64 0x0))) (var rax))) (storew 0 (+ (var rax) (bv 64 0x0)) (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor [rsi], rbx" 48311e 0x0 (seq (set _xor (^ (loadw 0 64 (+ (var rsi) (bv 64 0x0))) (var rbx))) (storew 0 (+ (var rsi) (bv 64 0x0)) (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor rax, rax" 4831c0 0x0 (seq (set _xor (^ (var rax) (var rax))) (set rax (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xor rdx, rdx" 4831d2 0x0 (seq (set _xor (^ (var rdx) (var rdx))) (set rdx (var _xor)) (set of false) (set cf false) (set _result (var _xor)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "xlatb" d7 0x0 (set rax (| (& (var rax) (~ (bv 64 0xff))) (cast 64 false (loadw 0 8 (+ (+ (var rbx) (bv 64 0x0)) (cast 64 false (cast 8 false (var rax)))))))) a "rep movsd" f3a5 a "repnz stosd" f2ab a "repz monitor" f30f01c8 a "repe vmcall" f30f01c1 a "repne sfence" f20faef8 a "rep rdpmc" f30f33 -a "mov eax, 33" b821000000 -a "mov rax, 33" 48c7c021000000 -a "mov dword ptr [rbp+4],0" c7450400000000 -a "mov qword ptr [rbp+4],0" 48c7450400000000 -a "mov [rbp+4],0" 48c7450400000000 -a "mov [ebp+4],0" 67c7450400000000 -ad "push r8" 4150 -ad "push r9" 4151 -ad "push r10" 4152 -ad "push r11" 4153 -ad "push r12" 4154 -ad "push r13" 4155 -ad "push r14" 4156 -ad "push r15" 4157 +a "mov eax, 33" b821000000 0x0 (set rax (| (& (var rax) (~ (bv 64 0xffffffff))) (cast 64 false (bv 32 0x21)))) +a "mov rax, 33" 48c7c021000000 0x0 (set rax (bv 64 0x21)) +a "mov dword ptr [rbp+4],0" c7450400000000 0x0 (storew 0 (+ (var rbp) (bv 64 0x4)) (bv 32 0x0)) +a "mov qword ptr [rbp+4],0" 48c7450400000000 0x0 (storew 0 (+ (var rbp) (bv 64 0x4)) (bv 64 0x0)) +a "mov [rbp+4],0" 48c7450400000000 0x0 (storew 0 (+ (var rbp) (bv 64 0x4)) (bv 64 0x0)) +a "mov [ebp+4],0" 67c7450400000000 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rbp))) (bv 64 0x4)) (bv 32 0x0)) +ad "push r8" 4150 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (var r8)))) +ad "push r9" 4151 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (var r9)))) +ad "push r10" 4152 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (var r10)))) +ad "push r11" 4153 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (var r11)))) +ad "push r12" 4154 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (var r12)))) +ad "push r13" 4155 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (var r13)))) +ad "push r14" 4156 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (var r14)))) +ad "push r15" 4157 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (var r15)))) -ad "call r8" 41ffd0 -ad "call r9" 41ffd1 -ad "call r10" 41ffd2 -ad "call r11" 41ffd3 -ad "call r12" 41ffd4 -ad "call r13" 41ffd5 -ad "call r14" 41ffd6 -ad "call r15" 41ffd7 -a "mov dword ptr [rax],0x1" c70001000000 -a "mov qword [rax], 0x1" 48c70001000000 -a "mov [rax], 0x1" 48c70001000000 -a "mov byte ptr [rip+0x203cb8],0x1" c605b83c200001 -a "mov dword ptr [rip+0x203817],0x42" c7051738200042000000 -a "mov dword ptr [rip+0x20380b],0x54" c7050b38200054000000 -a "mov dword ptr [rip+0x2037ff],0x4f" c705ff3720004f000000 -a "mov dword ptr [rip+0x2037f3],0x49" c705f337200049000000 -a "mov dword ptr [rip+0x2037e7],0x30" c705e737200030000000 -a "mov byte ptr [rbp-0x110a],0x49" c685f6eeffff49 -a "mov dword ptr [rbp-0x1100],0x0" c78500efffff00000000 -a "mov dword ptr [rbp-0x10fc],0x0" c78504efffff00000000 -a "mov byte ptr [rbp-0x110a],0x49" c685f6eeffff49 -a "mov byte ptr [rbp-0x110a],0x66" c685f6eeffff66 -a "mov qword ptr [rbp-0x10b0],0x0" 48c78550efffff00000000 -a "mov dword ptr [rbp-0x10f8],0x0" c78508efffff00000000 -a "mov dword ptr [rbp-0x10f8],0x0" c78508efffff00000000 -a "mov dword ptr [rbp-0x10d4],0xc" c7852cefffff0c000000 -a "mov dword ptr [rbp-0x1100],0x0" c78500efffff00000000 -a "mov byte ptr [rbp-0x110a],0x42" c685f6eeffff42 -a "mov byte ptr [rbp-0x110a],0x54" c685f6eeffff54 -a "mov byte ptr [rbp-0x110a],0x46" c685f6eeffff46 -a "mov byte ptr [rax],0x30" c60030 -a "mov byte ptr [rbp-0x110a],0x42" c685f6eeffff42 -a "mov byte ptr [rax],0x30" c60030 -a "mov byte ptr [rbp-0x110a],0x54" c685f6eeffff54 -a "mov byte ptr [rax],0x30" c60030 -a "mov byte ptr [rbp-0x110a],0x4f" c685f6eeffff4f -a "mov byte ptr [rax],0x30" c60030 -a "mov byte ptr [rbp-0x110a],0x49" c685f6eeffff49 -a "mov byte ptr [rax],0x62" c60062 -a "mov byte ptr [rbp-0x110a],0x49" c685f6eeffff49 -a "mov byte ptr [rax],0x74" c60074 -a "mov byte ptr [rax],0x0" c60000 -a "mov byte ptr [rax],0x0" c60000 -a "mov dword ptr [rbp-0x10],0x0" c745f000000000 -a "mov byte ptr [rax],0x0" c60000 -a "mov byte ptr [rax],0x0" c60000 -a "mov dword ptr [rbp-0x10],0xffffffff" c745f0ffffffff -a "mov dword ptr [rbp-0x10],0x1" c745f001000000 -a "mov dword ptr [rbp-0x4],0x1" c745fc01000000 -a "mov byte ptr [rip+0x207200],0x1" c6050072200001 -a "mov dword ptr [rbp-0xc],0x0" c745f400000000 -a "mov qword ptr [rip+0x2687bd],0x0" 48c705bd87260000000000 -a "mov dword ptr [rbp-0x18c],0x0" c78574feffff00000000 -a "mov dword ptr [rbp-0x18c],0x1" c78574feffff01000000 -a "mov dword ptr [rbp-0x114],0x0" c785ecfeffff00000000 -a "mov qword ptr [rbp-0x20],0x0" 48c745e000000000 -a "mov qword ptr [rbp-0x18],0x0" 48c745e800000000 -a "mov byte ptr [rax],0x0" c60000 -a "mov qword ptr [rip+0x2068f4],0x0" 48c705f468200000000000 -a "mov byte ptr [rbp-0x31],0x0" c645cf00 -a "mov byte ptr [rbp-0x31],0x1" c645cf01 -a "mov qword ptr [rbp-0x28],0x0" 48c745d800000000 -a "mov qword ptr [rbp-0x288],0x0" 48c78578fdffff00000000 -a "mov qword ptr [rbp-0x280],0x0" 48c78580fdffff00000000 -a "mov qword ptr [rbp-0x270],0x0" 48c78590fdffff00000000 -a "mov qword ptr [rbp-0x268],0x0" 48c78598fdffff00000000 -a "mov qword ptr [rbp-0x260],0x0" 48c785a0fdffff00000000 -a "mov qword ptr [rbp-0x1d0],0x0" 48c78530feffff00000000 -a "mov dword ptr [rbp-0x2c4],0x0" c7853cfdffff00000000 -a "mov dword ptr [rbp-0x2c0],0x0" c78540fdffff00000000 -a "mov dword ptr [rbp-0x2bc],0x0" c78544fdffff00000000 -a "mov byte ptr [rbp-0x2d4],0x0" c6852cfdffff00 -a "mov dword ptr [rbp-0x2b8],0x0" c78548fdffff00000000 -a "mov byte ptr [rbp-0x2d3],0x0" c6852dfdffff00 -a "mov dword ptr [rbp-0x2b4],0x0" c7854cfdffff00000000 -a "mov dword ptr [rbp-0x2b0],0x1" c78550fdffff01000000 -a "mov dword ptr [rbp-0x2ac],0x1" c78554fdffff01000000 -a "mov dword ptr [rbp-0x2a4],0x5" c7855cfdffff05000000 -a "mov byte ptr [rbp-0x2d2],0x0" c6852efdffff00 -a "mov byte ptr [rbp-0x2d1],0x0" c6852ffdffff00 -a "mov qword ptr [rbp-0x248],0x0" 48c785b8fdffff00000000 -a "mov qword ptr [rbp-0x240],0x0" 48c785c0fdffff00000000 -a "mov qword ptr [rbp-0x230],0x0" 48c785d0fdffff00000000 -a "mov qword ptr [rbp-0x228],0x0" 48c785d8fdffff00000000 -a "mov qword ptr [rbp-0x220],0x0" 48c785e0fdffff00000000 -a "mov qword ptr [rbp-0x218],0x0" 48c785e8fdffff00000000 -a "mov qword ptr [rbp-0x210],0x0" 48c785f0fdffff00000000 -a "mov qword ptr [rbp-0x208],0x0" 48c785f8fdffff00000000 -a "mov byte ptr [rbp-0x2d0],0x0" c68530fdffff00 -a "mov byte ptr [rbp-0x2cf],0x0" c68531fdffff00 -a "mov dword ptr [rbp-0x2a0],0x0" c78560fdffff00000000 -a "mov qword ptr [rbp-0x200],0x0" 48c78500feffff00000000 -a "mov byte ptr [rbp-0x2ce],0x0" c68532fdffff00 -a "mov dword ptr [rbp-0x2b8],0x1" c78548fdffff01000000 -a "mov dword ptr [rbp-0x2b8],0x0" c78548fdffff00000000 -a "mov dword ptr [rip+0x267855],0x1" c7055578260001000000 -a "mov byte ptr [rbp-0x2ce],0x1" c68532fdffff01 -a "mov byte ptr [rbp-0x2d3],0x1" c6852dfdffff01 -a "mov byte ptr [rbp-0x2d0],0x1" c68530fdffff01 -a "mov dword ptr [rbp-0x2bc],0x1" c78544fdffff01000000 -a "mov dword ptr [rbp-0x2c4],0x1" c7853cfdffff01000000 -a "mov dword ptr [rbp-0x2c4],0x2" c7853cfdffff02000000 -a "mov byte ptr [rbp-0x2d4],0x1" c6852cfdffff01 -a "mov byte ptr [rbp-0x2d1],0x1" c6852ffdffff01 -a "mov dword ptr [rbp-0x2ac],0x0" c78554fdffff00000000 -a "mov byte ptr [rbp-0x2d0],0x1" c68530fdffff01 -a "mov byte ptr [rbp-0x2cf],0x1" c68531fdffff01 -a "mov byte ptr [rbp-0x2d0],0x1" c68530fdffff01 -a "mov byte ptr [rip+0x205ab2],0x1" c605b25a200001 -a "mov byte ptr [rbp-0x2d2],0x1" c6852efdffff01 -a "mov byte ptr [rip+0x205a32],0x1" c605325a200001 -a "mov word ptr [rbp-0x98],0x6c" 66c78568ffffff6c00 -a "mov qword ptr [rbp-0x1f8],0x0" 48c78508feffff00000000 -a "mov byte ptr [rax],0x0" c60000 -a "mov qword ptr [rbp-0x248],0x0" 48c785b8fdffff00000000 -a "mov byte ptr [rip+0x205443],0x1" c6054354200001 -a "mov byte ptr [rax],0x0" c60000 -a "mov dword ptr [rbp-0x2c4],0x2" c7853cfdffff02000000 -a "mov dword ptr [rbp-0x2e4],0x2" c7851cfdffff02000000 -a "mov qword ptr [rbp-0x158],0x0" 48c785a8feffff00000000 -a "mov qword ptr [rbp-0x148],0x0" 48c785b8feffff00000000 -a "mov dword ptr [rbp-0x2a4],0x7" c7855cfdffff07000000 -a "mov dword ptr [rbp-0x2a4],0x5" c7855cfdffff05000000 -a "mov dword ptr [rbp-0x2c4],0x2" c7853cfdffff02000000 -a "mov qword ptr [rbp-0x120],0x0" 48c785e0feffff00000000 -a "mov qword ptr [rbp-0x1e0],0x0" 48c78520feffff00000000 -a "mov qword ptr [rbp-0x248],0x0" 48c785b8fdffff00000000 -a "mov qword ptr [rbp-0x1d8],0x0" 48c78528feffff00000000 -a "mov dword ptr [rbp-0x2b0],0xffffffff" c78550fdffffffffffff -a "mov dword ptr [rax+0x8],0xffffffff" c74008ffffffff -a "mov dword ptr [rbp-0x2a8],0x0" c78558fdffff00000000 -a "mov qword ptr [rax+0x10],0x0" 48c7401000000000 -a "mov dword ptr [rax+0x8],0xffffffff" c74008ffffffff -a "mov qword ptr [rax+0x10],0x0" 48c7401000000000 -a "mov qword ptr [rbp-0x288],0x0" 48c78578fdffff00000000 -a "mov qword ptr [rbp-0x280],0x0" 48c78580fdffff00000000 -a "mov byte ptr [rip+0x2049a0],0x1" c605a049200001 -a "mov qword ptr [rip+0x20489f],0x0" 48c7059f48200000000000 -a "mov qword ptr [rip+0x2047f9],0x0" 48c705f947200000000000 -a "mov dword ptr [rip+0x2047c7],0x1" c705c747200001000000 -a "mov dword ptr [rip+0x2047b6],0x0" c705b647200000000000 -a "mov dword ptr [rbp-0x4],0x0" c745fc00000000 -a "mov dword ptr [rbp-0x78],0x0" c7458800000000 -a "mov byte ptr [rbp-0x79],0x1" c6458701 -a "mov qword ptr [rbp-0x60],0x1" 48c745a001000000 -a "mov byte ptr [rbp-0x79],0x0" c6458700 -a "mov qword ptr [rbp-0x60],0x1" 48c745a001000000 -a "mov qword ptr [rbp-0x20],0x0" 48c745e000000000 -a "mov qword ptr [rbp-0x20],0x0" 48c745e000000000 -a "mov dword ptr [rbp-0x28],0x0" c745d800000000 -a "mov dword ptr [rbp-0x24],0x0" c745dc00000000 -a "mov dword ptr [rbp-0xd8],0x0" c78528ffffff00000000 -a "mov dword ptr [rbp-0xd4],0x0" c7852cffffff00000000 -a "mov dword ptr [rbp-0xd0],0x0" c78530ffffff00000000 -a "mov dword ptr [rbp-0xcc],0x0" c78534ffffff00000000 -a "mov qword ptr [rbp-0x98],0x0" 48c78568ffffff00000000 -a "mov qword ptr [rbp-0x90],0x0" 48c78570ffffff00000000 -a "mov qword ptr [rbp-0x88],0x0" 48c78578ffffff00000000 -a "mov qword ptr [rbp-0x80],0x0" 48c7458000000000 -a "mov qword ptr [rbp-0x78],0x0" 48c7458800000000 -a "mov dword ptr [rbp-0xc8],0xffffffff" c78538ffffffffffffff -a "mov qword ptr [rbp-0x70],0x0" 48c7459000000000 -a "mov qword ptr [rbp-0x68],0x0" 48c7459800000000 -a "mov qword ptr [rbp-0x60],0x0" 48c745a000000000 -a "mov qword ptr [rbp-0x58],0x0" 48c745a800000000 -a "mov dword ptr [rbp-0xc4],0xffffffff" c7853cffffffffffffff -a "mov dword ptr [rbp-0xc0],0x0" c78540ffffff00000000 -a "mov qword ptr [rbp-0x50],0x0" 48c745b000000000 -a "mov dword ptr [rbp-0xd8],0x6a" c78528ffffff6a000000 -a "mov dword ptr [rbp-0xd0],0x1" c78530ffffff01000000 -a "mov dword ptr [rbp-0xcc],0x1" c78534ffffff01000000 -a "mov dword ptr [rbp-0xd8],0x1" c78528ffffff01000000 -a "mov dword ptr [rbp-0xd8],0x2" c78528ffffff02000000 -a "mov dword ptr [rip+0x2032e9],0x0" c705e932200000000000 -a "mov dword ptr [rbp-0xc0],0x0" c78540ffffff00000000 -a "mov dword ptr [rbp-0xc0],0x1" c78540ffffff01000000 -a "mov byte ptr [rbp-0xe1],0x0" c6851fffffff00 -a "mov qword ptr [rip+0x202ebe],0x0" 48c705be2e200000000000 -a "mov dword ptr [rbp-0xe0],0x0" c78520ffffff00000000 -a "mov qword ptr [rbp-0x50],0x0" 48c745b000000000 -a "mov byte ptr [rax],0x0" c60000 -a "mov byte ptr [rax],0x0" c60000 -a "mov byte ptr [rax],0x0" c60000 -a "mov qword ptr [rbp-0xa8],0x1" 48c78558ffffff01000000 -a "mov qword ptr [rip+0x202865],0x0" 48c7056528200000000000 -a "mov dword ptr [rbp-0xe0],0x0" c78520ffffff00000000 -a "mov dword ptr [rbp-0xdc],0x0" c78524ffffff00000000 -a "mov byte ptr [rip+0x2013e0],0x1" c605e013200001 -a "mov byte ptr [rbp-0x2d],0x0" c645d300 -a "mov dword ptr [rbp-0x28],0x0" c745d800000000 -a "mov byte ptr [rbp-0x2d],0x1" c645d301 -a "mov byte ptr [rip+0x201f30],0x1" c605301f200001 -a "mov dword ptr [rbp-0xc],0x0" c745f400000000 -a "mov dword ptr [rax],0x2e2e2e" c7002e2e2e00 -a "mov byte ptr [rax],0x0" c60000 -a "mov byte ptr [rbp-0x2d],0x0" c645d300 -a "mov byte ptr [rbp-0x2d],0x1" c645d301 -a "mov dword ptr [rip+0x2015f2],0x1" c705f215200001000000 -a "mov byte ptr [rip+0x201606],0x1" c6050616200001 -a "mov dword ptr [rip+0x2015f3],0x1" c705f315200001000000 -a "mov dword ptr [rip+0x20159c],0x7" c7059c15200007000000 -a "mov dword ptr [rip+0x20158d],0x1" c7058d15200001000000 -a "mov dword ptr [rip+0x2015eb],0x0" c705eb15200000000000 -a "mov dword ptr [rip+0x201558],0x0" c7055815200000000000 -a "mov dword ptr [rip+0x2015b6],0x0" c705b615200000000000 -a "mov dword ptr [rip+0x2015b0],0x0" c705b015200000000000 -a "mov dword ptr [rip+0x201519],0x0" c7051915200000000000 -a "mov dword ptr [rip+0x201577],0x0" c7057715200000000000 -a "mov dword ptr [rip+0x201571],0x1" c7057115200001000000 -a "mov dword ptr [rip+0x2014b7],0x0" c705b714200000000000 -a "mov dword ptr [rip+0x201515],0x1" c7051515200001000000 -a "mov dword ptr [rip+0x20150f],0x0" c7050f15200000000000 -a "mov dword ptr [rip+0x2013e2],0x3" c705e213200003000000 -a "mov dword ptr [rip+0x2013fe],0x1" c705fe13200001000000 -a "mov byte ptr [rip+0x204578],0x1" c6057845200001 -a "mov byte ptr [rax],0x0" c60000 -a "mov byte ptr [rax],0x0" c60000 -a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 -a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 -a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 -a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 -a "mov dword ptr [rip+0x203d10],0x1" c705103d200001000000 -a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 -a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 -a "mov dword ptr [rbp-0x164],0x0" c7859cfeffff00000000 -a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 -a "mov dword ptr [rbp-0x160],0x0" c785a0feffff00000000 -a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 -a "mov qword ptr [rbp-0x10],0x0" 48c745f000000000 -a "mov word ptr [rbp-0x3c],0x0" 66c745c40000 -a "mov dword ptr [rbp-0x38],0x0" c745c800000000 -a "mov byte ptr [rbp-0x3d],0x0" c645c300 -a "mov word ptr [rbp-0x3a],0x0" 66c745c60000 -a "mov dword ptr [rbp-0x34],0x0" c745cc00000000 -a "mov byte ptr [rbp-0x3e],0xf9" c645c2f9 -a "mov byte ptr [rbp-0x3e],0xfc" c645c2fc -a "mov byte ptr [rbp-0x3e],0xff" c645c2ff -a "mov dword ptr [rbp-0x2c],0x7fffffff" c745d4ffffff7f -a "mov qword ptr [rbp-0x20],0x0" 48c745e000000000 -a "mov byte ptr [rbp-0x2c],0xf7" c645d4f7 -a "mov byte ptr [rbp-0x2c],0xf8" c645d4f8 -a "mov dword ptr [rbp-0x30],0x7fffffff" c745d0ffffff7f -a "mov qword ptr [rbp-0x18],0x0" 48c745e800000000 -a "mov byte ptr [rbp-0x2c],0xf8" c645d4f8 -a "mov dword ptr [rbp-0xc],0x2" c745f402000000 -a "mov dword ptr [rbp-0x8],0x0" c745f800000000 -a "mov dword ptr [rbp-0x14],0x0" c745ec00000000 -a "mov dword ptr [rbp-0xc],0xffffffff" c745f4ffffffff -a "mov dword ptr [rbp-0xc],0x2" c745f402000000 -a "mov dword ptr [rbp-0x10],0x0" c745f000000000 -a "mov dword ptr [rbp-0x10],0x0" c745f000000000 -a "mov dword ptr [rbp-0x10],0x0" c745f000000000 -a "mov dword ptr [rbp-0x10],0x0" c745f000000000 -a "mov dword ptr [rbp-0x10],0x0" c745f000000000 -a "mov dword ptr [rbp-0x10],0x0" c745f000000000 -a "mov dword ptr [rbp-0x10],0x0" c745f000000000 -a "mov dword ptr [rbp-0x14],0x0" c745ec00000000 -a "mov dword ptr [rbp-0x14],0x0" c745ec00000000 -a "mov qword ptr [rbp-0x20],0x0" 48c745e000000000 -a "mov qword ptr [rbp-0x20],0x0" 48c745e000000000 -a "mov qword ptr [rbp-0x38],0x0" 48c745c800000000 -a "mov dword ptr [rax],0x0" c70000000000 -a "mov qword ptr [rbp-0x38],0x0" 48c745c800000000 -a "mov byte ptr [rax],0xa" c6000a -a "mov byte ptr [rax],0x0" c60000 -a "mov qword ptr [rbp-0x28],0x0" 48c745d800000000 -a "mov dword ptr [rax],0x0" c70000000000 -a "mov qword ptr [rbp-0x28],0x0" 48c745d800000000 -a "mov byte ptr [rax],0xa" c6000a -a "mov byte ptr [rax],0x0" c60000 -a "mov qword ptr [rbp-0x70],0x0" 48c7459000000000 -a "mov qword ptr [rbp-0x68],0x0" 48c7459800000000 -a "mov qword ptr [rbp-0x80],0x0" 48c7458000000000 -a "mov qword ptr [rbp-0x50],0x0" 48c745b000000000 -a "mov dword ptr [rbp-0x98],0x0" c78568ffffff00000000 -a "mov dword ptr [rbp-0x94],0x0" c7856cffffff00000000 -a "mov dword ptr [rbp-0x90],0x0" c78570ffffff00000000 -a "mov dword ptr [rbp-0x8c],0xffffffff" c78574ffffffffffffff -a "mov dword ptr [rip+0x202447],0x42" c7054724200042000000 -a "mov dword ptr [rip+0x2023db],0x0" c705db23200000000000 -a "mov dword ptr [rip+0x202408],0x72" c7050824200072000000 -a "mov dword ptr [rbp-0x94],0x7" c7856cffffff07000000 -a "mov dword ptr [rip+0x2023b3],0x1" c705b323200001000000 -a "mov dword ptr [rbp-0x94],0x6" c7856cffffff06000000 -a "mov dword ptr [rbp-0x94],0x2" c7856cffffff02000000 -a "mov dword ptr [rip+0x20238e],0x1" c7058e23200001000000 -a "mov dword ptr [rbp-0x90],0x1" c78570ffffff01000000 -a "mov dword ptr [rbp-0x98],0x1" c78568ffffff01000000 -a "mov byte ptr [rip+0x202337],0x1" c6053723200001 -a "mov byte ptr [rip+0x20232f],0x0" c6052f23200000 -a "mov dword ptr [rbp-0x94],0x6" c7856cffffff06000000 -a "mov byte ptr [rip+0x202319],0x1" c6051923200001 -a "mov dword ptr [rbp-0x94],0x5" c7856cffffff05000000 -a "mov dword ptr [rbp-0x94],0x4" c7856cffffff04000000 -a "mov dword ptr [rbp-0x94],0x3" c7856cffffff03000000 -a "mov dword ptr [rbp-0x94],0x8" c7856cffffff08000000 -a "mov dword ptr [rip+0x20229f],0x75" c7059f22200075000000 -a "mov dword ptr [rip+0x202293],0x55" c7059322200055000000 -a "mov byte ptr [rip+0x20227f],0x1" c6057f22200001 -a "mov byte ptr [rip+0x202294],0x1" c6059422200001 -a "mov dword ptr [rip+0x202264],0x6a" c705642220006a000000 -a "mov dword ptr [rbp-0x94],0x1" c7856cffffff01000000 -a "mov dword ptr [rbp-0x94],0x0" c7856cffffff00000000 -a "mov dword ptr [rbp-0x88],0x40" c78578ffffff40000000 -a "mov byte ptr [rax],0x0" c60000 -a "mov dword ptr [rax+0x24],0x6c" c740246c000000 -a "mov dword ptr [rax+0x24],0x6d" c740246d000000 -a "mov dword ptr [rax+0x24],0x0" c7402400000000 -a "mov byte ptr [rip+0x206cd8],0x1" c605d86c200001 -a "mov byte ptr [rax],0x0" c60000 -a "mov dword ptr [rbp-0x64],0x0" c7459c00000000 -a "mov qword ptr [rbp-0x50],0x0" 48c745b000000000 -a "mov qword ptr [rbp-0x20],0x0" 48c745e000000000 -a "mov qword ptr [rbp-0x48],0x0" 48c745b800000000 -a "mov qword ptr [rbp-0x40],0x0" 48c745c000000000 -a "mov qword ptr [rbp-0x38],0x0" 48c745c800000000 -a "mov dword ptr [rbp-0x60],0x0" c745a000000000 -a "mov dword ptr [rbp-0x5c],0x0" c745a400000000 -a "mov byte ptr [rbp-0x65],0x0" c6459b00 -a "mov byte ptr [rax],0x0" c60000 -a "mov byte ptr [rbp-0x65],0x0" c6459b00 -a "mov byte ptr [rbp-0x65],0x1" c6459b01 -a "mov qword ptr [rax+0x8],0x0" 48c7400800000000 -a "mov qword ptr [rbp-0x10],0x0" 48c745f000000000 -a "mov dword ptr [rbp-0x20],0x0" c745e000000000 -a "mov dword ptr [rbp-0x1c],0x0" c745e400000000 -a "mov dword ptr [rbp-0x34],0x20" c745cc20000000 -a "mov qword ptr [rbp-0x20],0x0" 48c745e000000000 -a "mov qword ptr [rbp-0x38],0x0" 48c745c800000000 -a "mov qword ptr [rbp-0x30],0x0" 48c745d000000000 -a "mov byte ptr [rbp-0x3d],0x1" c645c301 -a "mov byte ptr [rax],0x0" c60000 -a "mov byte ptr [rax],0x0" c60000 -a "mov qword ptr [rbp-0x8],0x0" 48c745f800000000 -a "mov dword ptr [rbp-0x4],0x0" c745fc00000000 -a "mov dword ptr [rbp-0x4],0x6a" c745fc6a000000 -a "mov dword ptr [rbp-0x4],0x71" c745fc71000000 -a "mov qword ptr [rbp-0x61920],0x0" 48c785e0e6f9ff00000000 -a "mov dword ptr [rbp-0x61954],0x0" c785ace6f9ff00000000 -a "mov dword ptr [rbp-0x61958],0x0" c785a8e6f9ff00000000 -a "mov dword ptr [rbp-0x61950],0x0" c785b0e6f9ff00000000 -a "mov qword ptr [rbp-0x61918],0x0" 48c785e8e6f9ff00000000 -a "mov qword ptr [rbp-0x61910],0x0" 48c785f0e6f9ff00000000 -a "mov qword ptr [rbp-0x61908],0x0" 48c785f8e6f9ff00000000 -a "mov qword ptr [rbp-0x61900],0x0" 48c78500e7f9ff00000000 -a "mov qword ptr [rbp-0x618f8],0x0" 48c78508e7f9ff00000000 -a "mov qword ptr [rbp-0x618f0],0x0" 48c78510e7f9ff00000000 -a "mov qword ptr [rbp-0x618d0],0x0" 48c78530e7f9ff00000000 -a "mov dword ptr [rbp-0x61938],0x0" c785c8e6f9ff00000000 -a "mov dword ptr [rbp-0x6194c],0x0" c785b4e6f9ff00000000 -a "mov dword ptr [rbp-0x61948],0xffffffff" c785b8e6f9ffffffffff -a "mov dword ptr [rip+0x20531b],0x8" c7051b53200008000000 -a "mov dword ptr [rax+0x190],0x0" c7809001000000000000 -a "mov dword ptr [rip+0x20525c],0x40" c7055c52200040000000 -a "mov dword ptr [rbp-0x6194c],0x2" c785b4e6f9ff02000000 -a "mov dword ptr [rbp-0x6194c],0x1" c785b4e6f9ff01000000 -a "mov dword ptr [rip+0x204e5f],0x1" c7055f4e200001000000 -a "mov dword ptr [rip+0x204d51],0x0" c705514d200000000000 -a "mov dword ptr [rip+0x204d6a],0x1" c7056a4d200001000000 -a "mov dword ptr [rip+0x204cdc],0x0" c705dc4c200000000000 -a "mov qword ptr [rbp-0x618e8],0x0" 48c78518e7f9ff00000000 -a "mov qword ptr [rbp-0x618e0],0x0" 48c78520e7f9ff00000000 -a "mov qword ptr [rbp-0x618e0],0x0" 48c78520e7f9ff00000000 -a "mov qword ptr [rip+0x2049d8],0x0" 48c705d849200000000000 -a "mov byte ptr [rax],0x0" c60000 -a "mov qword ptr [rbp-0x618d8],0x0" 48c78528e7f9ff00000000 -a "mov qword ptr [rbp-0x61898],0x0" 48c78568e7f9ff00000000 -a "mov byte ptr [rax],0x0" c60000 -a "mov byte ptr [rax],0x0" c60000 -a "mov qword ptr [rbp-0x618d8],0x0" 48c78528e7f9ff00000000 -a "mov dword ptr [rbp-0x61944],0x0" c785bce6f9ff00000000 -a "mov dword ptr [rbp-0x61954],0x20" c785ace6f9ff20000000 -a "mov dword ptr [rbp-0x6193c],0x0" c785c4e6f9ff00000000 -a "mov dword ptr [rbp-0x6193c],0x1" c785c4e6f9ff01000000 -a "mov dword ptr [rbp-0x6194c],0x0" c785b4e6f9ff00000000 -a "mov dword ptr [rax+0x40c],0x0" c7800c04000000000000 -a "mov qword ptr [rbp-0x618c8],0x0" 48c78538e7f9ff00000000 -a "mov byte ptr [rip+0x2037e8],0x1" c605e837200001 -a "mov qword ptr [rbp-0x4a0],0x0" 48c78560fbffff00000000 -a "mov qword ptr [rbp-0x508],0x0" 48c785f8faffff00000000 -a "mov qword ptr [rbp-0x500],0x0" 48c78500fbffff00000000 -a "mov qword ptr [rbp-0x4f8],0x0" 48c78508fbffff00000000 -a "mov qword ptr [rbp-0x4f0],0x0" 48c78510fbffff00000000 -a "mov dword ptr [rbp-0x550],0x0" c785b0faffff00000000 -a "mov dword ptr [rbp-0x54c],0x1" c785b4faffff01000000 -a "mov dword ptr [rbp-0x548],0x0" c785b8faffff00000000 -a "mov dword ptr [rbp-0x544],0x0" c785bcfaffff00000000 -a "mov dword ptr [rbp-0x540],0x0" c785c0faffff00000000 -a "mov dword ptr [rbp-0x53c],0x0" c785c4faffff00000000 -a "mov qword ptr [rbp-0x4d0],0x0" 48c78530fbffff00000000 -a "mov qword ptr [rbp-0x4c8],0x0" 48c78538fbffff00000000 -a "mov qword ptr [rbp-0x4c0],0x0" 48c78540fbffff00000000 -a "mov qword ptr [rbp-0x4b8],0x0" 48c78548fbffff00000000 -a "mov dword ptr [rbp-0x538],0x40" c785c8faffff40000000 -a "mov dword ptr [rbp-0x534],0x0" c785ccfaffff00000000 -a "mov qword ptr [rbp-0x4b0],0x0" 48c78550fbffff00000000 -a "mov dword ptr [rbp-0x530],0x0" c785d0faffff00000000 -a "mov dword ptr [rbp-0x548],0x1" c785b8faffff01000000 -a "mov dword ptr [rbp-0x54c],0x0" c785b4faffff00000000 -a "mov byte ptr [rax],0x0" c60000 -a "mov dword ptr [rbp-0x540],0x1" c785c0faffff01000000 -a "mov dword ptr [rbp-0x540],0x1" c785c0faffff01000000 -a "mov byte ptr [rax],0x0" c60000 -a "mov byte ptr [rax],0x3a" c6003a -a "mov dword ptr [rbp-0x530],0x1" c785d0faffff01000000 -a "mov byte ptr [rax],0x0" c60000 -a "mov dword ptr [rbp-0x548],0x0" c785b8faffff00000000 -a "mov dword ptr [rbp-0x548],0x0" c785b8faffff00000000 -a "mov dword ptr [rbp-0x548],0x1" c785b8faffff01000000 -a "mov dword ptr [rbp-0x54c],0x0" c785b4faffff00000000 -a "mov dword ptr [rbp-0x544],0x1" c785bcfaffff01000000 -a "mov dword ptr [rbp-0x550],0x1" c785b0faffff01000000 -a "mov dword ptr [rbp-0x53c],0x1" c785c4faffff01000000 -a "mov qword ptr [rbp-0x4d0],0x1" 48c78530fbffff01000000 -a "mov dword ptr [rbp-0x534],0x61" c785ccfaffff61000000 -a "mov dword ptr [rbp-0x534],0x0" c785ccfaffff00000000 -a "mov qword ptr [rbp-0x4f8],0x0" 48c78508fbffff00000000 -a "mov byte ptr [rax],0x0" c60000 -a "mov dword ptr [rbp-0x52c],0x0" c785d4faffff00000000 -a "mov dword ptr [rbp-0x52c],0x0" c785d4faffff00000000 -a "mov byte ptr [rip+0x201148],0x1" c6054811200001 -a "mov dword ptr [rbp-0x5c],0x3" c745a403000000 -a "mov dword ptr [rbp-0x64],0x0" c7459c00000000 -a "mov dword ptr [rbp-0x60],0x0" c745a000000000 -a "mov byte ptr [rbp-0x65],0x1" c6459b01 -a "mov byte ptr [rbp-0x65],0x0" c6459b00 -a "mov dword ptr [rbp-0x60],0x1" c745a001000000 -a "mov dword ptr [rbp-0x64],0x1" c7459c01000000 -a "mov qword ptr [rbp-0x38],0x0" 48c745c800000000 -a "mov qword ptr [rbp-0x38],0x0" 48c745c800000000 -a "mov byte ptr [rip+0x204568],0x1" c6056845200001 -a "mov dword ptr [rbp-0x210],0x0" c785f0fdffff00000000 -a "mov dword ptr [rbp-0x1d0],0x0" c78530feffff00000000 -a "mov dword ptr [rbp-0x70],0x0" c7459000000000 -a "mov byte ptr [rbp-0x30],0x0" c645d000 -a "mov word ptr [rax],0x3732" 66c7003237 -a "mov byte ptr [rax+0x2],0x0" c6400200 -a "mov word ptr [rax],0x2038" 66c7003820 -a "mov byte ptr [rax+0x2],0x0" c6400200 -a "mov dword ptr [rax],0x203631" c70031362000 -a "mov dword ptr [rax],0x203233" c70033322000 -a "mov dword ptr [rax],0x203436" c70036342000 -a "mov qword ptr [rbp-0x18],0x0" 48c745e800000000 -a "mov qword ptr [rbp-0x10],0x0" 48c745f000000000 -a "mov qword ptr [rbp-0x338],0x0" 48c785c8fcffff00000000 -a "mov dword ptr [rbp-0x340],0x0" c785c0fcffff00000000 -a "mov qword ptr [rbp-0x330],0x0" 48c785d0fcffff00000000 -a "mov dword ptr [rbp-0x340],0x0" c785c0fcffff00000000 -a "mov dword ptr [rbp-0x2f0],0x0" c78510fdffff00000000 -a "mov dword ptr [rbp-0x320],0x1" c785e0fcffff01000000 -a "mov dword ptr [rbp-0x4],0x1" c745fc01000000 -a "mov dword ptr [rbp-0x4],0x1" c745fc01000000 -a "mov dword ptr [rbp-0x14],0x0" c745ec00000000 -a "mov dword ptr [rbp-0x1c],0x0" c745e400000000 -a "mov dword ptr [rbp-0x18],0x0" c745e800000000 -a "mov dword ptr [rbp-0x4],0x0" c745fc00000000 -a "mov qword ptr [rbp-0x1d8],0x0" 48c78528feffff00000000 -a "mov qword ptr [rbp-0x1d0],0x0" 48c78530feffff00000000 -a "mov qword ptr [rbp-0x1c8],0x0" 48c78538feffff00000000 -a "mov qword ptr [rbp-0x1c0],0x0" 48c78540feffff00000000 -a "mov qword ptr [rbp-0x1b8],0x0" 48c78548feffff00000000 -a "mov byte ptr [rbp-0x215],0x0" c685ebfdffff00 -a "mov byte ptr [rbp-0x214],0x0" c685ecfdffff00 -a "mov byte ptr [rbp-0x213],0x0" c685edfdffff00 -a "mov qword ptr [rbp-0x1b0],0x0" 48c78550feffff00000000 -a "mov dword ptr [rbp-0x20c],0xffffffff" c785f4fdffffffffffff -a "mov dword ptr [rbp-0x208],0x0" c785f8fdffff00000000 -a "mov dword ptr [rbp-0x204],0x0" c785fcfdffff00000000 -a "mov dword ptr [rbp-0x200],0x0" c78500feffff00000000 -a "mov dword ptr [rbp-0x1fc],0x0" c78504feffff00000000 -a "mov dword ptr [rbp-0x1f8],0x20" c78508feffff20000000 -a "mov dword ptr [rbp-0x1f4],0x0" c7850cfeffff00000000 -a "mov dword ptr [rbp-0x1f0],0x0" c78510feffff00000000 -a "mov qword ptr [rbp-0x1a8],0x0" 48c78558feffff00000000 -a "mov qword ptr [rbp-0x1a0],0x0" 48c78560feffff00000000 -a "mov qword ptr [rbp-0x198],0x0" 48c78568feffff00000000 -a "mov byte ptr [rbp-0x212],0x0" c685eefdffff00 -a "mov dword ptr [rbp-0x1e8],0x40" c78518feffff40000000 -a "mov byte ptr [rbp-0x212],0x1" c685eefdffff01 -a "mov dword ptr [rbp-0x200],0x1" c78500feffff01000000 -a "mov dword ptr [rip+0x202b89],0x1" c705892b200001000000 -a "mov dword ptr [rbp-0x208],0x1" c785f8fdffff01000000 -a "mov dword ptr [rbp-0x208],0x2" c785f8fdffff02000000 -a "mov byte ptr [rbp-0x215],0x1" c685ebfdffff01 -a "mov dword ptr [rbp-0x208],0x3" c785f8fdffff03000000 -a "mov byte ptr [rip+0x202af2],0x1" c605f22a200001 -a "mov dword ptr [rbp-0x1fc],0x1" c78504feffff01000000 -a "mov byte ptr [rbp-0x213],0x1" c685edfdffff01 -a "mov byte ptr [rip+0x2029f3],0x1" c605f329200001 -a "mov byte ptr [rbp-0x214],0x1" c685ecfdffff01 -a "mov dword ptr [rbp-0x1f4],0x1" c7850cfeffff01000000 -a "mov dword ptr [rbp-0x1fc],0x0" c78504feffff00000000 -a "mov dword ptr [rbp-0x204],0x1" c785fcfdffff01000000 -a "mov dword ptr [rbp-0x1fc],0x0" c78504feffff00000000 -a "mov dword ptr [rbp-0x1fc],0x0" c78504feffff00000000 -a "mov dword ptr [rbp-0x1fc],0x1" c78504feffff01000000 -a "mov dword ptr [rbp-0x1fc],0x0" c78504feffff00000000 -a "mov byte ptr [rax],0x0" c60000 -a "mov byte ptr [rax],0x3a" c6003a -a "mov dword ptr [rbp-0x210],0x0" c785f0fdffff00000000 -a "mov byte ptr [rbp+rax*1-0x120],0x0" c68405e0feffff00 -a "mov byte ptr [rax],0x0" c60000 -a "mov dword ptr [rbp-0x1fc],0x1" c78504feffff01000000 -a "mov byte ptr [rbp+rax*1-0x120],0x0" c68405e0feffff00 -a "mov byte ptr [rbp+rax*1-0x120],0x0" c68405e0feffff00 -a "mov byte ptr [rax],0x0" c60000 -a "mov byte ptr [rip+0x201cd3],0x1" c605d31c200001 -a "mov byte ptr [rip+0x206f90],0x1" c605906f200001 -a "mov qword ptr [rbp-0x10],0x0" 48c745f000000000 -a "mov byte ptr [rax+0xc8],0x0" c680c800000000 -a "mov dword ptr [rax+0xb0],0xffffffff" c780b0000000ffffffff -a "mov dword ptr [rax+0x74],0x40" c7407440000000 -a "mov dword ptr [rax+0xbc],0xffffffff" c780bc000000ffffffff -a "mov qword ptr [rax+0x10],0x9c4" 48c74010c4090000 -a "mov dword ptr [rax+0x6c],0x1000" c7406c00100000 -a "mov dword ptr [rax+0xc0],0xa" c780c00000000a000000 -a "mov qword ptr [rax+0x8],0x0" 48c7400800000000 -a "mov qword ptr [rax+0x20],0x1000" 48c7402000100000 -a "mov qword ptr [rax],0x0" 48c70000000000 -a "mov dword ptr [rax+0x60],0x0" c7406000000000 -a "mov dword ptr [rax+0x38],0x0" c7403800000000 -a "mov qword ptr [rax+0x48],0x0" 48c7404800000000 -a "mov qword ptr [rax+0x50],0x1000" 48c7405000100000 -a "mov qword ptr [rax],0x0" 48c70000000000 -a "mov qword ptr [rax+0x18],0x0" 48c7401800000000 -a "mov dword ptr [rax+0xc4],0x0" c780c400000000000000 -a "mov qword ptr [rax+0x40],0x0" 48c7404000000000 -a "mov qword ptr [rax+0x8],0x0" 48c7400800000000 -a "mov qword ptr [rax],0x0" 48c70000000000 -a "mov qword ptr [rax+0x18],0x0" 48c7401800000000 -a "mov dword ptr [rbp-0x8],0x0" c745f800000000 -a "mov dword ptr [rbp-0x4],0x0" c745fc00000000 -a "mov byte ptr [rbp-0xa],0x1" c645f601 -a "mov byte ptr [rax],0x0" c60000 -a "mov dword ptr [rbp-0x8],0x0" c745f800000000 -a "mov byte ptr [rax],0x0" c60000 -a "mov qword ptr [rax+0x28],0x0" 48c7402800000000 -a "mov byte ptr [rax+0x4],0x0" c6400400 -a "mov byte ptr [rax+0x5],0x0" c6400500 -a "mov dword ptr [rax+0x8],0x1" c7400801000000 -a "mov byte ptr [rbp-0xa],0x0" c645f600 -a "mov qword ptr [rbp-0x20],0x0" 48c745e000000000 -a "mov dword ptr [rbp-0x18],0x0" c745e800000000 -a "mov qword ptr [rax+0x48],0x0" 48c7404800000000 -a "mov byte ptr [rax],0x0" c60000 -a "mov qword ptr [rax+0x48],0x0" 48c7404800000000 -a "mov dword ptr [rbp-0x2c],0x0" c745d400000000 -a "mov byte ptr [rax],0x0" c60000 -a "mov byte ptr [rax],0x0" c60000 -a "mov byte ptr [rax],0x24" c60024 -a "mov qword ptr [rax+0x8],0x1" 48c7400801000000 -a "mov byte ptr [rax],0x7d" c6007d -a "mov dword ptr [rbp-0x14],0x0" c745ec00000000 -a "mov dword ptr [rbp-0x14],0x22" c745ec22000000 -a "mov dword ptr [rbp-0x14],0x7e" c745ec7e000000 -a "mov byte ptr [rax],0x2a" c6002a -a "mov byte ptr [rax],0x0" c60000 -a "mov qword ptr [rbp-0x18],0x0" 48c745e800000000 -a "mov dword ptr [rax+0xc4],0x1" c780c400000001000000 -a "mov dword ptr [rax+0xc4],0x1" c780c400000001000000 -a "mov dword ptr [rax+0xc4],0x1" c780c400000001000000 -a "mov byte ptr [rbp-0x1],0x0" c645ff00 -a "mov qword ptr [rbp-0x8],0x0" 48c745f800000000 -a "mov qword ptr [rbp-0x8],0x0" 48c745f800000000 -a "mov dword ptr [rbp-0x8],0x0" c745f800000000 -a "mov byte ptr [rax],0x0" c60000 -a "mov dword ptr [rbp-0x1c],0x0" c745e400000000 -a "mov dword ptr [rbp-0x18],0x0" c745e800000000 -a "mov byte ptr [rax],0x0" c60000 -a "mov dword ptr [rbp-0x84],0x0" c7857cffffff00000000 -a "mov byte ptr [rax],0x0" c60000 -a "mov dword ptr [rax],0xffffffff" c700ffffffff -a "mov dword ptr [rax],0xffffffff" c700ffffffff -a "mov dword ptr [rax],0xffffffff" c700ffffffff -a "mov dword ptr [esp+0x1c],0xc6670001" 67c744241c010067c6 -a "mov byte ptr [esi],0x86" 67c60686 -a "mov word ptr [esi],0x4020" 6766c7062040 -a "mov word ptr [esi],0x4020" 6766c7062040 -a "mov dword ptr [esi],0x404020" 67c70620404000 -a "mov byte ptr [esp+0x25],0xc0" 67c6442425c0 -a "mov dword ptr [esp+0x20],0x66670014" 67c744242014006766 -a "mov dword ptr [esp+0x1c],0x534d4150" 67c744241c50414d53 -a "mov dword ptr [edx],0x74000000" 67c70200000074 -a "mov dword ptr [eax+eax*1],0xa740000" 67c704000000740a -a "mov dword ptr [esp],0x1" 67c7042401000000 -a "mov dword ptr [esp+0x4],0x0" 67c744240400000000 -a "mov dword ptr [esp+0x4],0x0" 67c744240400000000 -a "mov dword ptr [esi],0xb0003e04" 67c706043e00b0 -a "mov dword ptr [esi],0xb8003e04" 67c706043e00b8 -a "mov word ptr [esi],0x3d04" 6766c706043d -a "mov dword ptr [esp+0xc],0x3" 67c744240c03000000 -a "mov dword ptr [esp+0xc],0x1" 67c744240c01000000 -a "mov word ptr [esp+0x10],0x0" 6766c74424100000 -a "mov word ptr [esp+0x14],0x0" 6766c74424140000 -a "mov dword ptr [esp+0x24],0x66671a00" 67c7442424001a6766 -a "mov word ptr [esi],0x5078" 6766c7067850 -a "mov byte ptr [esi],0x7f" 67c6067f -a "mov dword ptr [esi],0x15078" 67c70678500100 -a "mov word ptr [esi],0x5078" 6766c7067850 -a "mov dword ptr [esp+0x24],0x66670f00" 67c7442424000f6766 -a "mov word ptr [esi],0x5084" 6766c7068450 -a "mov dword ptr [ebp-0x44],0x31660305" 67c745bc05036631 -a "mov dword ptr [ebp-0x4c],0x47534943" 67c745b443495347 +ad "call r8" 41ffd0 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0)))) +ad "call r9" 41ffd1 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0)))) +ad "call r10" 41ffd2 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0)))) +ad "call r11" 41ffd3 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0)))) +ad "call r12" 41ffd4 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0)))) +ad "call r13" 41ffd5 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0)))) +ad "call r14" 41ffd6 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0)))) +ad "call r15" 41ffd7 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0)))) +a "mov dword ptr [rax],0x1" c70001000000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 32 0x1)) +a "mov qword [rax], 0x1" 48c70001000000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 64 0x1)) +a "mov [rax], 0x1" 48c70001000000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 64 0x1)) +a "mov byte ptr [rip+0x203cb8],0x1" c605b83c200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x203cb8)) (bv 8 0x1)) +a "mov dword ptr [rip+0x203817],0x42" c7051738200042000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x203817)) (bv 32 0x42)) +a "mov dword ptr [rip+0x20380b],0x54" c7050b38200054000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20380b)) (bv 32 0x54)) +a "mov dword ptr [rip+0x2037ff],0x4f" c705ff3720004f000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2037ff)) (bv 32 0x4f)) +a "mov dword ptr [rip+0x2037f3],0x49" c705f337200049000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2037f3)) (bv 32 0x49)) +a "mov dword ptr [rip+0x2037e7],0x30" c705e737200030000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2037e7)) (bv 32 0x30)) +a "mov byte ptr [rbp-0x110a],0x49" c685f6eeffff49 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffeef6)) (bv 8 0x49)) +a "mov dword ptr [rbp-0x1100],0x0" c78500efffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffef00)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x10fc],0x0" c78504efffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffef04)) (bv 32 0x0)) +a "mov byte ptr [rbp-0x110a],0x49" c685f6eeffff49 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffeef6)) (bv 8 0x49)) +a "mov byte ptr [rbp-0x110a],0x66" c685f6eeffff66 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffeef6)) (bv 8 0x66)) +a "mov qword ptr [rbp-0x10b0],0x0" 48c78550efffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffef50)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x10f8],0x0" c78508efffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffef08)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x10f8],0x0" c78508efffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffef08)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x10d4],0xc" c7852cefffff0c000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffef2c)) (bv 32 0xc)) +a "mov dword ptr [rbp-0x1100],0x0" c78500efffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffef00)) (bv 32 0x0)) +a "mov byte ptr [rbp-0x110a],0x42" c685f6eeffff42 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffeef6)) (bv 8 0x42)) +a "mov byte ptr [rbp-0x110a],0x54" c685f6eeffff54 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffeef6)) (bv 8 0x54)) +a "mov byte ptr [rbp-0x110a],0x46" c685f6eeffff46 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffeef6)) (bv 8 0x46)) +a "mov byte ptr [rax],0x30" c60030 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x30)) +a "mov byte ptr [rbp-0x110a],0x42" c685f6eeffff42 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffeef6)) (bv 8 0x42)) +a "mov byte ptr [rax],0x30" c60030 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x30)) +a "mov byte ptr [rbp-0x110a],0x54" c685f6eeffff54 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffeef6)) (bv 8 0x54)) +a "mov byte ptr [rax],0x30" c60030 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x30)) +a "mov byte ptr [rbp-0x110a],0x4f" c685f6eeffff4f 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffeef6)) (bv 8 0x4f)) +a "mov byte ptr [rax],0x30" c60030 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x30)) +a "mov byte ptr [rbp-0x110a],0x49" c685f6eeffff49 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffeef6)) (bv 8 0x49)) +a "mov byte ptr [rax],0x62" c60062 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x62)) +a "mov byte ptr [rbp-0x110a],0x49" c685f6eeffff49 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffeef6)) (bv 8 0x49)) +a "mov byte ptr [rax],0x74" c60074 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x74)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov dword ptr [rbp-0x10],0x0" c745f000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff0)) (bv 32 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov dword ptr [rbp-0x10],0xffffffff" c745f0ffffffff 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff0)) (bv 32 0xffffffff)) +a "mov dword ptr [rbp-0x10],0x1" c745f001000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff0)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x4],0x1" c745fc01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffffc)) (bv 32 0x1)) +a "mov byte ptr [rip+0x207200],0x1" c6050072200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x207200)) (bv 8 0x1)) +a "mov dword ptr [rbp-0xc],0x0" c745f400000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff4)) (bv 32 0x0)) +a "mov qword ptr [rip+0x2687bd],0x0" 48c705bd87260000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2687bd)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x18c],0x0" c78574feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe74)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x18c],0x1" c78574feffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe74)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x114],0x0" c785ecfeffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffeec)) (bv 32 0x0)) +a "mov qword ptr [rbp-0x20],0x0" 48c745e000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe0)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x18],0x0" 48c745e800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe8)) (bv 64 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov qword ptr [rip+0x2068f4],0x0" 48c705f468200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2068f4)) (bv 64 0x0)) +a "mov byte ptr [rbp-0x31],0x0" c645cf00 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffcf)) (bv 8 0x0)) +a "mov byte ptr [rbp-0x31],0x1" c645cf01 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffcf)) (bv 8 0x1)) +a "mov qword ptr [rbp-0x28],0x0" 48c745d800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd8)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x288],0x0" 48c78578fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd78)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x280],0x0" 48c78580fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd80)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x270],0x0" 48c78590fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd90)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x268],0x0" 48c78598fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd98)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x260],0x0" 48c785a0fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffda0)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x1d0],0x0" 48c78530feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe30)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x2c4],0x0" c7853cfdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd3c)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x2c0],0x0" c78540fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd40)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x2bc],0x0" c78544fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd44)) (bv 32 0x0)) +a "mov byte ptr [rbp-0x2d4],0x0" c6852cfdffff00 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd2c)) (bv 8 0x0)) +a "mov dword ptr [rbp-0x2b8],0x0" c78548fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd48)) (bv 32 0x0)) +a "mov byte ptr [rbp-0x2d3],0x0" c6852dfdffff00 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd2d)) (bv 8 0x0)) +a "mov dword ptr [rbp-0x2b4],0x0" c7854cfdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd4c)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x2b0],0x1" c78550fdffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd50)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x2ac],0x1" c78554fdffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd54)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x2a4],0x5" c7855cfdffff05000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd5c)) (bv 32 0x5)) +a "mov byte ptr [rbp-0x2d2],0x0" c6852efdffff00 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd2e)) (bv 8 0x0)) +a "mov byte ptr [rbp-0x2d1],0x0" c6852ffdffff00 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd2f)) (bv 8 0x0)) +a "mov qword ptr [rbp-0x248],0x0" 48c785b8fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdb8)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x240],0x0" 48c785c0fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdc0)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x230],0x0" 48c785d0fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdd0)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x228],0x0" 48c785d8fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdd8)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x220],0x0" 48c785e0fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffde0)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x218],0x0" 48c785e8fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffde8)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x210],0x0" 48c785f0fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdf0)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x208],0x0" 48c785f8fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdf8)) (bv 64 0x0)) +a "mov byte ptr [rbp-0x2d0],0x0" c68530fdffff00 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd30)) (bv 8 0x0)) +a "mov byte ptr [rbp-0x2cf],0x0" c68531fdffff00 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd31)) (bv 8 0x0)) +a "mov dword ptr [rbp-0x2a0],0x0" c78560fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd60)) (bv 32 0x0)) +a "mov qword ptr [rbp-0x200],0x0" 48c78500feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe00)) (bv 64 0x0)) +a "mov byte ptr [rbp-0x2ce],0x0" c68532fdffff00 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd32)) (bv 8 0x0)) +a "mov dword ptr [rbp-0x2b8],0x1" c78548fdffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd48)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x2b8],0x0" c78548fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd48)) (bv 32 0x0)) +a "mov dword ptr [rip+0x267855],0x1" c7055578260001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x267855)) (bv 32 0x1)) +a "mov byte ptr [rbp-0x2ce],0x1" c68532fdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd32)) (bv 8 0x1)) +a "mov byte ptr [rbp-0x2d3],0x1" c6852dfdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd2d)) (bv 8 0x1)) +a "mov byte ptr [rbp-0x2d0],0x1" c68530fdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd30)) (bv 8 0x1)) +a "mov dword ptr [rbp-0x2bc],0x1" c78544fdffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd44)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x2c4],0x1" c7853cfdffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd3c)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x2c4],0x2" c7853cfdffff02000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd3c)) (bv 32 0x2)) +a "mov byte ptr [rbp-0x2d4],0x1" c6852cfdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd2c)) (bv 8 0x1)) +a "mov byte ptr [rbp-0x2d1],0x1" c6852ffdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd2f)) (bv 8 0x1)) +a "mov dword ptr [rbp-0x2ac],0x0" c78554fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd54)) (bv 32 0x0)) +a "mov byte ptr [rbp-0x2d0],0x1" c68530fdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd30)) (bv 8 0x1)) +a "mov byte ptr [rbp-0x2cf],0x1" c68531fdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd31)) (bv 8 0x1)) +a "mov byte ptr [rbp-0x2d0],0x1" c68530fdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd30)) (bv 8 0x1)) +a "mov byte ptr [rip+0x205ab2],0x1" c605b25a200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x205ab2)) (bv 8 0x1)) +a "mov byte ptr [rbp-0x2d2],0x1" c6852efdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd2e)) (bv 8 0x1)) +a "mov byte ptr [rip+0x205a32],0x1" c605325a200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x205a32)) (bv 8 0x1)) +a "mov word ptr [rbp-0x98],0x6c" 66c78568ffffff6c00 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff68)) (bv 16 0x6c)) +a "mov qword ptr [rbp-0x1f8],0x0" 48c78508feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe08)) (bv 64 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov qword ptr [rbp-0x248],0x0" 48c785b8fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdb8)) (bv 64 0x0)) +a "mov byte ptr [rip+0x205443],0x1" c6054354200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x205443)) (bv 8 0x1)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov dword ptr [rbp-0x2c4],0x2" c7853cfdffff02000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd3c)) (bv 32 0x2)) +a "mov dword ptr [rbp-0x2e4],0x2" c7851cfdffff02000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd1c)) (bv 32 0x2)) +a "mov qword ptr [rbp-0x158],0x0" 48c785a8feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffea8)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x148],0x0" 48c785b8feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffeb8)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x2a4],0x7" c7855cfdffff07000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd5c)) (bv 32 0x7)) +a "mov dword ptr [rbp-0x2a4],0x5" c7855cfdffff05000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd5c)) (bv 32 0x5)) +a "mov dword ptr [rbp-0x2c4],0x2" c7853cfdffff02000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd3c)) (bv 32 0x2)) +a "mov qword ptr [rbp-0x120],0x0" 48c785e0feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffee0)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x1e0],0x0" 48c78520feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe20)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x248],0x0" 48c785b8fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdb8)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x1d8],0x0" 48c78528feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe28)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x2b0],0xffffffff" c78550fdffffffffffff 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd50)) (bv 32 0xffffffff)) +a "mov dword ptr [rax+0x8],0xffffffff" c74008ffffffff 0x0 (storew 0 (+ (var rax) (bv 64 0x8)) (bv 32 0xffffffff)) +a "mov dword ptr [rbp-0x2a8],0x0" c78558fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd58)) (bv 32 0x0)) +a "mov qword ptr [rax+0x10],0x0" 48c7401000000000 0x0 (storew 0 (+ (var rax) (bv 64 0x10)) (bv 64 0x0)) +a "mov dword ptr [rax+0x8],0xffffffff" c74008ffffffff 0x0 (storew 0 (+ (var rax) (bv 64 0x8)) (bv 32 0xffffffff)) +a "mov qword ptr [rax+0x10],0x0" 48c7401000000000 0x0 (storew 0 (+ (var rax) (bv 64 0x10)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x288],0x0" 48c78578fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd78)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x280],0x0" 48c78580fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd80)) (bv 64 0x0)) +a "mov byte ptr [rip+0x2049a0],0x1" c605a049200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2049a0)) (bv 8 0x1)) +a "mov qword ptr [rip+0x20489f],0x0" 48c7059f48200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20489f)) (bv 64 0x0)) +a "mov qword ptr [rip+0x2047f9],0x0" 48c705f947200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2047f9)) (bv 64 0x0)) +a "mov dword ptr [rip+0x2047c7],0x1" c705c747200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2047c7)) (bv 32 0x1)) +a "mov dword ptr [rip+0x2047b6],0x0" c705b647200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2047b6)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x4],0x0" c745fc00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffffc)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x78],0x0" c7458800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff88)) (bv 32 0x0)) +a "mov byte ptr [rbp-0x79],0x1" c6458701 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff87)) (bv 8 0x1)) +a "mov qword ptr [rbp-0x60],0x1" 48c745a001000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffa0)) (bv 64 0x1)) +a "mov byte ptr [rbp-0x79],0x0" c6458700 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff87)) (bv 8 0x0)) +a "mov qword ptr [rbp-0x60],0x1" 48c745a001000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffa0)) (bv 64 0x1)) +a "mov qword ptr [rbp-0x20],0x0" 48c745e000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe0)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x20],0x0" 48c745e000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe0)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x28],0x0" c745d800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd8)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x24],0x0" c745dc00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffdc)) (bv 32 0x0)) +a "mov dword ptr [rbp-0xd8],0x0" c78528ffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff28)) (bv 32 0x0)) +a "mov dword ptr [rbp-0xd4],0x0" c7852cffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff2c)) (bv 32 0x0)) +a "mov dword ptr [rbp-0xd0],0x0" c78530ffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff30)) (bv 32 0x0)) +a "mov dword ptr [rbp-0xcc],0x0" c78534ffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff34)) (bv 32 0x0)) +a "mov qword ptr [rbp-0x98],0x0" 48c78568ffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff68)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x90],0x0" 48c78570ffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff70)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x88],0x0" 48c78578ffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff78)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x80],0x0" 48c7458000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff80)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x78],0x0" 48c7458800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff88)) (bv 64 0x0)) +a "mov dword ptr [rbp-0xc8],0xffffffff" c78538ffffffffffffff 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff38)) (bv 32 0xffffffff)) +a "mov qword ptr [rbp-0x70],0x0" 48c7459000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff90)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x68],0x0" 48c7459800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff98)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x60],0x0" 48c745a000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffa0)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x58],0x0" 48c745a800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffa8)) (bv 64 0x0)) +a "mov dword ptr [rbp-0xc4],0xffffffff" c7853cffffffffffffff 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff3c)) (bv 32 0xffffffff)) +a "mov dword ptr [rbp-0xc0],0x0" c78540ffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff40)) (bv 32 0x0)) +a "mov qword ptr [rbp-0x50],0x0" 48c745b000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffb0)) (bv 64 0x0)) +a "mov dword ptr [rbp-0xd8],0x6a" c78528ffffff6a000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff28)) (bv 32 0x6a)) +a "mov dword ptr [rbp-0xd0],0x1" c78530ffffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff30)) (bv 32 0x1)) +a "mov dword ptr [rbp-0xcc],0x1" c78534ffffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff34)) (bv 32 0x1)) +a "mov dword ptr [rbp-0xd8],0x1" c78528ffffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff28)) (bv 32 0x1)) +a "mov dword ptr [rbp-0xd8],0x2" c78528ffffff02000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff28)) (bv 32 0x2)) +a "mov dword ptr [rip+0x2032e9],0x0" c705e932200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2032e9)) (bv 32 0x0)) +a "mov dword ptr [rbp-0xc0],0x0" c78540ffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff40)) (bv 32 0x0)) +a "mov dword ptr [rbp-0xc0],0x1" c78540ffffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff40)) (bv 32 0x1)) +a "mov byte ptr [rbp-0xe1],0x0" c6851fffffff00 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff1f)) (bv 8 0x0)) +a "mov qword ptr [rip+0x202ebe],0x0" 48c705be2e200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202ebe)) (bv 64 0x0)) +a "mov dword ptr [rbp-0xe0],0x0" c78520ffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff20)) (bv 32 0x0)) +a "mov qword ptr [rbp-0x50],0x0" 48c745b000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffb0)) (bv 64 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov qword ptr [rbp-0xa8],0x1" 48c78558ffffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff58)) (bv 64 0x1)) +a "mov qword ptr [rip+0x202865],0x0" 48c7056528200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202865)) (bv 64 0x0)) +a "mov dword ptr [rbp-0xe0],0x0" c78520ffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff20)) (bv 32 0x0)) +a "mov dword ptr [rbp-0xdc],0x0" c78524ffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff24)) (bv 32 0x0)) +a "mov byte ptr [rip+0x2013e0],0x1" c605e013200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2013e0)) (bv 8 0x1)) +a "mov byte ptr [rbp-0x2d],0x0" c645d300 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd3)) (bv 8 0x0)) +a "mov dword ptr [rbp-0x28],0x0" c745d800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd8)) (bv 32 0x0)) +a "mov byte ptr [rbp-0x2d],0x1" c645d301 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd3)) (bv 8 0x1)) +a "mov byte ptr [rip+0x201f30],0x1" c605301f200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x201f30)) (bv 8 0x1)) +a "mov dword ptr [rbp-0xc],0x0" c745f400000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff4)) (bv 32 0x0)) +a "mov dword ptr [rax],0x2e2e2e" c7002e2e2e00 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 32 0x2e2e2e)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov byte ptr [rbp-0x2d],0x0" c645d300 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd3)) (bv 8 0x0)) +a "mov byte ptr [rbp-0x2d],0x1" c645d301 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd3)) (bv 8 0x1)) +a "mov dword ptr [rip+0x2015f2],0x1" c705f215200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2015f2)) (bv 32 0x1)) +a "mov byte ptr [rip+0x201606],0x1" c6050616200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x201606)) (bv 8 0x1)) +a "mov dword ptr [rip+0x2015f3],0x1" c705f315200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2015f3)) (bv 32 0x1)) +a "mov dword ptr [rip+0x20159c],0x7" c7059c15200007000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20159c)) (bv 32 0x7)) +a "mov dword ptr [rip+0x20158d],0x1" c7058d15200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20158d)) (bv 32 0x1)) +a "mov dword ptr [rip+0x2015eb],0x0" c705eb15200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2015eb)) (bv 32 0x0)) +a "mov dword ptr [rip+0x201558],0x0" c7055815200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x201558)) (bv 32 0x0)) +a "mov dword ptr [rip+0x2015b6],0x0" c705b615200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2015b6)) (bv 32 0x0)) +a "mov dword ptr [rip+0x2015b0],0x0" c705b015200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2015b0)) (bv 32 0x0)) +a "mov dword ptr [rip+0x201519],0x0" c7051915200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x201519)) (bv 32 0x0)) +a "mov dword ptr [rip+0x201577],0x0" c7057715200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x201577)) (bv 32 0x0)) +a "mov dword ptr [rip+0x201571],0x1" c7057115200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x201571)) (bv 32 0x1)) +a "mov dword ptr [rip+0x2014b7],0x0" c705b714200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2014b7)) (bv 32 0x0)) +a "mov dword ptr [rip+0x201515],0x1" c7051515200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x201515)) (bv 32 0x1)) +a "mov dword ptr [rip+0x20150f],0x0" c7050f15200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20150f)) (bv 32 0x0)) +a "mov dword ptr [rip+0x2013e2],0x3" c705e213200003000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2013e2)) (bv 32 0x3)) +a "mov dword ptr [rip+0x2013fe],0x1" c705fe13200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2013fe)) (bv 32 0x1)) +a "mov byte ptr [rip+0x204578],0x1" c6057845200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x204578)) (bv 8 0x1)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe98)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe98)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe98)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe98)) (bv 32 0x0)) +a "mov dword ptr [rip+0x203d10],0x1" c705103d200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x203d10)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe98)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe98)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x164],0x0" c7859cfeffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe9c)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe98)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x160],0x0" c785a0feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffea0)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x168],0x0" c78598feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe98)) (bv 32 0x0)) +a "mov qword ptr [rbp-0x10],0x0" 48c745f000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff0)) (bv 64 0x0)) +a "mov word ptr [rbp-0x3c],0x0" 66c745c40000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffc4)) (bv 16 0x0)) +a "mov dword ptr [rbp-0x38],0x0" c745c800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffc8)) (bv 32 0x0)) +a "mov byte ptr [rbp-0x3d],0x0" c645c300 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffc3)) (bv 8 0x0)) +a "mov word ptr [rbp-0x3a],0x0" 66c745c60000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffc6)) (bv 16 0x0)) +a "mov dword ptr [rbp-0x34],0x0" c745cc00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffcc)) (bv 32 0x0)) +a "mov byte ptr [rbp-0x3e],0xf9" c645c2f9 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffc2)) (bv 8 0xf9)) +a "mov byte ptr [rbp-0x3e],0xfc" c645c2fc 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffc2)) (bv 8 0xfc)) +a "mov byte ptr [rbp-0x3e],0xff" c645c2ff 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffc2)) (bv 8 0xff)) +a "mov dword ptr [rbp-0x2c],0x7fffffff" c745d4ffffff7f 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd4)) (bv 32 0x7fffffff)) +a "mov qword ptr [rbp-0x20],0x0" 48c745e000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe0)) (bv 64 0x0)) +a "mov byte ptr [rbp-0x2c],0xf7" c645d4f7 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd4)) (bv 8 0xf7)) +a "mov byte ptr [rbp-0x2c],0xf8" c645d4f8 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd4)) (bv 8 0xf8)) +a "mov dword ptr [rbp-0x30],0x7fffffff" c745d0ffffff7f 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd0)) (bv 32 0x7fffffff)) +a "mov qword ptr [rbp-0x18],0x0" 48c745e800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe8)) (bv 64 0x0)) +a "mov byte ptr [rbp-0x2c],0xf8" c645d4f8 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd4)) (bv 8 0xf8)) +a "mov dword ptr [rbp-0xc],0x2" c745f402000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff4)) (bv 32 0x2)) +a "mov dword ptr [rbp-0x8],0x0" c745f800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff8)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x14],0x0" c745ec00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffec)) (bv 32 0x0)) +a "mov dword ptr [rbp-0xc],0xffffffff" c745f4ffffffff 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff4)) (bv 32 0xffffffff)) +a "mov dword ptr [rbp-0xc],0x2" c745f402000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff4)) (bv 32 0x2)) +a "mov dword ptr [rbp-0x10],0x0" c745f000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff0)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x10],0x0" c745f000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff0)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x10],0x0" c745f000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff0)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x10],0x0" c745f000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff0)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x10],0x0" c745f000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff0)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x10],0x0" c745f000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff0)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x10],0x0" c745f000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff0)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x14],0x0" c745ec00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffec)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x14],0x0" c745ec00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffec)) (bv 32 0x0)) +a "mov qword ptr [rbp-0x20],0x0" 48c745e000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe0)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x20],0x0" 48c745e000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe0)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x38],0x0" 48c745c800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffc8)) (bv 64 0x0)) +a "mov dword ptr [rax],0x0" c70000000000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 32 0x0)) +a "mov qword ptr [rbp-0x38],0x0" 48c745c800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffc8)) (bv 64 0x0)) +a "mov byte ptr [rax],0xa" c6000a 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0xa)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov qword ptr [rbp-0x28],0x0" 48c745d800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd8)) (bv 64 0x0)) +a "mov dword ptr [rax],0x0" c70000000000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 32 0x0)) +a "mov qword ptr [rbp-0x28],0x0" 48c745d800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd8)) (bv 64 0x0)) +a "mov byte ptr [rax],0xa" c6000a 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0xa)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov qword ptr [rbp-0x70],0x0" 48c7459000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff90)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x68],0x0" 48c7459800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff98)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x80],0x0" 48c7458000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff80)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x50],0x0" 48c745b000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffb0)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x98],0x0" c78568ffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff68)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x94],0x0" c7856cffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x90],0x0" c78570ffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff70)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x8c],0xffffffff" c78574ffffffffffffff 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff74)) (bv 32 0xffffffff)) +a "mov dword ptr [rip+0x202447],0x42" c7054724200042000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202447)) (bv 32 0x42)) +a "mov dword ptr [rip+0x2023db],0x0" c705db23200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2023db)) (bv 32 0x0)) +a "mov dword ptr [rip+0x202408],0x72" c7050824200072000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202408)) (bv 32 0x72)) +a "mov dword ptr [rbp-0x94],0x7" c7856cffffff07000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x7)) +a "mov dword ptr [rip+0x2023b3],0x1" c705b323200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2023b3)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x94],0x6" c7856cffffff06000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x6)) +a "mov dword ptr [rbp-0x94],0x2" c7856cffffff02000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x2)) +a "mov dword ptr [rip+0x20238e],0x1" c7058e23200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20238e)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x90],0x1" c78570ffffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff70)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x98],0x1" c78568ffffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff68)) (bv 32 0x1)) +a "mov byte ptr [rip+0x202337],0x1" c6053723200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202337)) (bv 8 0x1)) +a "mov byte ptr [rip+0x20232f],0x0" c6052f23200000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20232f)) (bv 8 0x0)) +a "mov dword ptr [rbp-0x94],0x6" c7856cffffff06000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x6)) +a "mov byte ptr [rip+0x202319],0x1" c6051923200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202319)) (bv 8 0x1)) +a "mov dword ptr [rbp-0x94],0x5" c7856cffffff05000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x5)) +a "mov dword ptr [rbp-0x94],0x4" c7856cffffff04000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x4)) +a "mov dword ptr [rbp-0x94],0x3" c7856cffffff03000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x3)) +a "mov dword ptr [rbp-0x94],0x8" c7856cffffff08000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x8)) +a "mov dword ptr [rip+0x20229f],0x75" c7059f22200075000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20229f)) (bv 32 0x75)) +a "mov dword ptr [rip+0x202293],0x55" c7059322200055000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202293)) (bv 32 0x55)) +a "mov byte ptr [rip+0x20227f],0x1" c6057f22200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20227f)) (bv 8 0x1)) +a "mov byte ptr [rip+0x202294],0x1" c6059422200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202294)) (bv 8 0x1)) +a "mov dword ptr [rip+0x202264],0x6a" c705642220006a000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202264)) (bv 32 0x6a)) +a "mov dword ptr [rbp-0x94],0x1" c7856cffffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x94],0x0" c7856cffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff6c)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x88],0x40" c78578ffffff40000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff78)) (bv 32 0x40)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov dword ptr [rax+0x24],0x6c" c740246c000000 0x0 (storew 0 (+ (var rax) (bv 64 0x24)) (bv 32 0x6c)) +a "mov dword ptr [rax+0x24],0x6d" c740246d000000 0x0 (storew 0 (+ (var rax) (bv 64 0x24)) (bv 32 0x6d)) +a "mov dword ptr [rax+0x24],0x0" c7402400000000 0x0 (storew 0 (+ (var rax) (bv 64 0x24)) (bv 32 0x0)) +a "mov byte ptr [rip+0x206cd8],0x1" c605d86c200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x206cd8)) (bv 8 0x1)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov dword ptr [rbp-0x64],0x0" c7459c00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff9c)) (bv 32 0x0)) +a "mov qword ptr [rbp-0x50],0x0" 48c745b000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffb0)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x20],0x0" 48c745e000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe0)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x48],0x0" 48c745b800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffb8)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x40],0x0" 48c745c000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffc0)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x38],0x0" 48c745c800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffc8)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x60],0x0" c745a000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffa0)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x5c],0x0" c745a400000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffa4)) (bv 32 0x0)) +a "mov byte ptr [rbp-0x65],0x0" c6459b00 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff9b)) (bv 8 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov byte ptr [rbp-0x65],0x0" c6459b00 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff9b)) (bv 8 0x0)) +a "mov byte ptr [rbp-0x65],0x1" c6459b01 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff9b)) (bv 8 0x1)) +a "mov qword ptr [rax+0x8],0x0" 48c7400800000000 0x0 (storew 0 (+ (var rax) (bv 64 0x8)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x10],0x0" 48c745f000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff0)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x20],0x0" c745e000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe0)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x1c],0x0" c745e400000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe4)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x34],0x20" c745cc20000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffcc)) (bv 32 0x20)) +a "mov qword ptr [rbp-0x20],0x0" 48c745e000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe0)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x38],0x0" 48c745c800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffc8)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x30],0x0" 48c745d000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd0)) (bv 64 0x0)) +a "mov byte ptr [rbp-0x3d],0x1" c645c301 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffc3)) (bv 8 0x1)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov qword ptr [rbp-0x8],0x0" 48c745f800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff8)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x4],0x0" c745fc00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffffc)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x4],0x6a" c745fc6a000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffffc)) (bv 32 0x6a)) +a "mov dword ptr [rbp-0x4],0x71" c745fc71000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffffc)) (bv 32 0x71)) +a "mov qword ptr [rbp-0x61920],0x0" 48c785e0e6f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6e0)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x61954],0x0" c785ace6f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6ac)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x61958],0x0" c785a8e6f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6a8)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x61950],0x0" c785b0e6f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6b0)) (bv 32 0x0)) +a "mov qword ptr [rbp-0x61918],0x0" 48c785e8e6f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6e8)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x61910],0x0" 48c785f0e6f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6f0)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x61908],0x0" 48c785f8e6f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6f8)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x61900],0x0" 48c78500e7f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e700)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x618f8],0x0" 48c78508e7f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e708)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x618f0],0x0" 48c78510e7f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e710)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x618d0],0x0" 48c78530e7f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e730)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x61938],0x0" c785c8e6f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6c8)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x6194c],0x0" c785b4e6f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6b4)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x61948],0xffffffff" c785b8e6f9ffffffffff 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6b8)) (bv 32 0xffffffff)) +a "mov dword ptr [rip+0x20531b],0x8" c7051b53200008000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20531b)) (bv 32 0x8)) +a "mov dword ptr [rax+0x190],0x0" c7809001000000000000 0x0 (storew 0 (+ (var rax) (bv 64 0x190)) (bv 32 0x0)) +a "mov dword ptr [rip+0x20525c],0x40" c7055c52200040000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x20525c)) (bv 32 0x40)) +a "mov dword ptr [rbp-0x6194c],0x2" c785b4e6f9ff02000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6b4)) (bv 32 0x2)) +a "mov dword ptr [rbp-0x6194c],0x1" c785b4e6f9ff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6b4)) (bv 32 0x1)) +a "mov dword ptr [rip+0x204e5f],0x1" c7055f4e200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x204e5f)) (bv 32 0x1)) +a "mov dword ptr [rip+0x204d51],0x0" c705514d200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x204d51)) (bv 32 0x0)) +a "mov dword ptr [rip+0x204d6a],0x1" c7056a4d200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x204d6a)) (bv 32 0x1)) +a "mov dword ptr [rip+0x204cdc],0x0" c705dc4c200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x204cdc)) (bv 32 0x0)) +a "mov qword ptr [rbp-0x618e8],0x0" 48c78518e7f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e718)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x618e0],0x0" 48c78520e7f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e720)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x618e0],0x0" 48c78520e7f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e720)) (bv 64 0x0)) +a "mov qword ptr [rip+0x2049d8],0x0" 48c705d849200000000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2049d8)) (bv 64 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov qword ptr [rbp-0x618d8],0x0" 48c78528e7f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e728)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x61898],0x0" 48c78568e7f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e768)) (bv 64 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov qword ptr [rbp-0x618d8],0x0" 48c78528e7f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e728)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x61944],0x0" c785bce6f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6bc)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x61954],0x20" c785ace6f9ff20000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6ac)) (bv 32 0x20)) +a "mov dword ptr [rbp-0x6193c],0x0" c785c4e6f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6c4)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x6193c],0x1" c785c4e6f9ff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6c4)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x6194c],0x0" c785b4e6f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e6b4)) (bv 32 0x0)) +a "mov dword ptr [rax+0x40c],0x0" c7800c04000000000000 0x0 (storew 0 (+ (var rax) (bv 64 0x40c)) (bv 32 0x0)) +a "mov qword ptr [rbp-0x618c8],0x0" 48c78538e7f9ff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffff9e738)) (bv 64 0x0)) +a "mov byte ptr [rip+0x2037e8],0x1" c605e837200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2037e8)) (bv 8 0x1)) +a "mov qword ptr [rbp-0x4a0],0x0" 48c78560fbffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffb60)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x508],0x0" 48c785f8faffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffaf8)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x500],0x0" 48c78500fbffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffb00)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x4f8],0x0" 48c78508fbffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffb08)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x4f0],0x0" 48c78510fbffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffb10)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x550],0x0" c785b0faffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffab0)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x54c],0x1" c785b4faffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffab4)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x548],0x0" c785b8faffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffab8)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x544],0x0" c785bcfaffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffabc)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x540],0x0" c785c0faffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffac0)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x53c],0x0" c785c4faffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffac4)) (bv 32 0x0)) +a "mov qword ptr [rbp-0x4d0],0x0" 48c78530fbffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffb30)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x4c8],0x0" 48c78538fbffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffb38)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x4c0],0x0" 48c78540fbffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffb40)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x4b8],0x0" 48c78548fbffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffb48)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x538],0x40" c785c8faffff40000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffac8)) (bv 32 0x40)) +a "mov dword ptr [rbp-0x534],0x0" c785ccfaffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffacc)) (bv 32 0x0)) +a "mov qword ptr [rbp-0x4b0],0x0" 48c78550fbffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffb50)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x530],0x0" c785d0faffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffad0)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x548],0x1" c785b8faffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffab8)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x54c],0x0" c785b4faffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffab4)) (bv 32 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov dword ptr [rbp-0x540],0x1" c785c0faffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffac0)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x540],0x1" c785c0faffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffac0)) (bv 32 0x1)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov byte ptr [rax],0x3a" c6003a 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x3a)) +a "mov dword ptr [rbp-0x530],0x1" c785d0faffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffad0)) (bv 32 0x1)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov dword ptr [rbp-0x548],0x0" c785b8faffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffab8)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x548],0x0" c785b8faffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffab8)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x548],0x1" c785b8faffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffab8)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x54c],0x0" c785b4faffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffab4)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x544],0x1" c785bcfaffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffabc)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x550],0x1" c785b0faffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffab0)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x53c],0x1" c785c4faffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffac4)) (bv 32 0x1)) +a "mov qword ptr [rbp-0x4d0],0x1" 48c78530fbffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffb30)) (bv 64 0x1)) +a "mov dword ptr [rbp-0x534],0x61" c785ccfaffff61000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffacc)) (bv 32 0x61)) +a "mov dword ptr [rbp-0x534],0x0" c785ccfaffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffacc)) (bv 32 0x0)) +a "mov qword ptr [rbp-0x4f8],0x0" 48c78508fbffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffb08)) (bv 64 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov dword ptr [rbp-0x52c],0x0" c785d4faffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffad4)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x52c],0x0" c785d4faffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffad4)) (bv 32 0x0)) +a "mov byte ptr [rip+0x201148],0x1" c6054811200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x201148)) (bv 8 0x1)) +a "mov dword ptr [rbp-0x5c],0x3" c745a403000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffa4)) (bv 32 0x3)) +a "mov dword ptr [rbp-0x64],0x0" c7459c00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff9c)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x60],0x0" c745a000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffa0)) (bv 32 0x0)) +a "mov byte ptr [rbp-0x65],0x1" c6459b01 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff9b)) (bv 8 0x1)) +a "mov byte ptr [rbp-0x65],0x0" c6459b00 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff9b)) (bv 8 0x0)) +a "mov dword ptr [rbp-0x60],0x1" c745a001000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffa0)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x64],0x1" c7459c01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff9c)) (bv 32 0x1)) +a "mov qword ptr [rbp-0x38],0x0" 48c745c800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffc8)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x38],0x0" 48c745c800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffc8)) (bv 64 0x0)) +a "mov byte ptr [rip+0x204568],0x1" c6056845200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x204568)) (bv 8 0x1)) +a "mov dword ptr [rbp-0x210],0x0" c785f0fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdf0)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x1d0],0x0" c78530feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe30)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x70],0x0" c7459000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff90)) (bv 32 0x0)) +a "mov byte ptr [rbp-0x30],0x0" c645d000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd0)) (bv 8 0x0)) +a "mov word ptr [rax],0x3732" 66c7003237 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 16 0x3732)) +a "mov byte ptr [rax+0x2],0x0" c6400200 0x0 (storew 0 (+ (var rax) (bv 64 0x2)) (bv 8 0x0)) +a "mov word ptr [rax],0x2038" 66c7003820 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 16 0x2038)) +a "mov byte ptr [rax+0x2],0x0" c6400200 0x0 (storew 0 (+ (var rax) (bv 64 0x2)) (bv 8 0x0)) +a "mov dword ptr [rax],0x203631" c70031362000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 32 0x203631)) +a "mov dword ptr [rax],0x203233" c70033322000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 32 0x203233)) +a "mov dword ptr [rax],0x203436" c70036342000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 32 0x203436)) +a "mov qword ptr [rbp-0x18],0x0" 48c745e800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe8)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x10],0x0" 48c745f000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff0)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x338],0x0" 48c785c8fcffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffcc8)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x340],0x0" c785c0fcffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffcc0)) (bv 32 0x0)) +a "mov qword ptr [rbp-0x330],0x0" 48c785d0fcffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffcd0)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x340],0x0" c785c0fcffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffcc0)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x2f0],0x0" c78510fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffd10)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x320],0x1" c785e0fcffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffce0)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x4],0x1" c745fc01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffffc)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x4],0x1" c745fc01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffffc)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x14],0x0" c745ec00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffec)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x1c],0x0" c745e400000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe4)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x18],0x0" c745e800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe8)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x4],0x0" c745fc00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffffc)) (bv 32 0x0)) +a "mov qword ptr [rbp-0x1d8],0x0" 48c78528feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe28)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x1d0],0x0" 48c78530feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe30)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x1c8],0x0" 48c78538feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe38)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x1c0],0x0" 48c78540feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe40)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x1b8],0x0" 48c78548feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe48)) (bv 64 0x0)) +a "mov byte ptr [rbp-0x215],0x0" c685ebfdffff00 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdeb)) (bv 8 0x0)) +a "mov byte ptr [rbp-0x214],0x0" c685ecfdffff00 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdec)) (bv 8 0x0)) +a "mov byte ptr [rbp-0x213],0x0" c685edfdffff00 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffded)) (bv 8 0x0)) +a "mov qword ptr [rbp-0x1b0],0x0" 48c78550feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe50)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x20c],0xffffffff" c785f4fdffffffffffff 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdf4)) (bv 32 0xffffffff)) +a "mov dword ptr [rbp-0x208],0x0" c785f8fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdf8)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x204],0x0" c785fcfdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdfc)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x200],0x0" c78500feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe00)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x1fc],0x0" c78504feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe04)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x1f8],0x20" c78508feffff20000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe08)) (bv 32 0x20)) +a "mov dword ptr [rbp-0x1f4],0x0" c7850cfeffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe0c)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x1f0],0x0" c78510feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe10)) (bv 32 0x0)) +a "mov qword ptr [rbp-0x1a8],0x0" 48c78558feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe58)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x1a0],0x0" 48c78560feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe60)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x198],0x0" 48c78568feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe68)) (bv 64 0x0)) +a "mov byte ptr [rbp-0x212],0x0" c685eefdffff00 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdee)) (bv 8 0x0)) +a "mov dword ptr [rbp-0x1e8],0x40" c78518feffff40000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe18)) (bv 32 0x40)) +a "mov byte ptr [rbp-0x212],0x1" c685eefdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdee)) (bv 8 0x1)) +a "mov dword ptr [rbp-0x200],0x1" c78500feffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe00)) (bv 32 0x1)) +a "mov dword ptr [rip+0x202b89],0x1" c705892b200001000000 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202b89)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x208],0x1" c785f8fdffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdf8)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x208],0x2" c785f8fdffff02000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdf8)) (bv 32 0x2)) +a "mov byte ptr [rbp-0x215],0x1" c685ebfdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdeb)) (bv 8 0x1)) +a "mov dword ptr [rbp-0x208],0x3" c785f8fdffff03000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdf8)) (bv 32 0x3)) +a "mov byte ptr [rip+0x202af2],0x1" c605f22a200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x202af2)) (bv 8 0x1)) +a "mov dword ptr [rbp-0x1fc],0x1" c78504feffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe04)) (bv 32 0x1)) +a "mov byte ptr [rbp-0x213],0x1" c685edfdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffded)) (bv 8 0x1)) +a "mov byte ptr [rip+0x2029f3],0x1" c605f329200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x2029f3)) (bv 8 0x1)) +a "mov byte ptr [rbp-0x214],0x1" c685ecfdffff01 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdec)) (bv 8 0x1)) +a "mov dword ptr [rbp-0x1f4],0x1" c7850cfeffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe0c)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x1fc],0x0" c78504feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe04)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x204],0x1" c785fcfdffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdfc)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x1fc],0x0" c78504feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe04)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x1fc],0x0" c78504feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe04)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x1fc],0x1" c78504feffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe04)) (bv 32 0x1)) +a "mov dword ptr [rbp-0x1fc],0x0" c78504feffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe04)) (bv 32 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov byte ptr [rax],0x3a" c6003a 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x3a)) +a "mov dword ptr [rbp-0x210],0x0" c785f0fdffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffdf0)) (bv 32 0x0)) +a "mov byte ptr [rbp+rax*1-0x120],0x0" c68405e0feffff00 0x0 (storew 0 (+ (+ (var rbp) (* (var rax) (bv 64 0x1))) (bv 64 0xfffffffffffffee0)) (bv 8 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov dword ptr [rbp-0x1fc],0x1" c78504feffff01000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffe04)) (bv 32 0x1)) +a "mov byte ptr [rbp+rax*1-0x120],0x0" c68405e0feffff00 0x0 (storew 0 (+ (+ (var rbp) (* (var rax) (bv 64 0x1))) (bv 64 0xfffffffffffffee0)) (bv 8 0x0)) +a "mov byte ptr [rbp+rax*1-0x120],0x0" c68405e0feffff00 0x0 (storew 0 (+ (+ (var rbp) (* (var rax) (bv 64 0x1))) (bv 64 0xfffffffffffffee0)) (bv 8 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov byte ptr [rip+0x201cd3],0x1" c605d31c200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x201cd3)) (bv 8 0x1)) +a "mov byte ptr [rip+0x206f90],0x1" c605906f200001 0x0 (storew 0 (+ (bv 64 0x0) (bv 64 0x206f90)) (bv 8 0x1)) +a "mov qword ptr [rbp-0x10],0x0" 48c745f000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff0)) (bv 64 0x0)) +a "mov byte ptr [rax+0xc8],0x0" c680c800000000 0x0 (storew 0 (+ (var rax) (bv 64 0xc8)) (bv 8 0x0)) +a "mov dword ptr [rax+0xb0],0xffffffff" c780b0000000ffffffff 0x0 (storew 0 (+ (var rax) (bv 64 0xb0)) (bv 32 0xffffffff)) +a "mov dword ptr [rax+0x74],0x40" c7407440000000 0x0 (storew 0 (+ (var rax) (bv 64 0x74)) (bv 32 0x40)) +a "mov dword ptr [rax+0xbc],0xffffffff" c780bc000000ffffffff 0x0 (storew 0 (+ (var rax) (bv 64 0xbc)) (bv 32 0xffffffff)) +a "mov qword ptr [rax+0x10],0x9c4" 48c74010c4090000 0x0 (storew 0 (+ (var rax) (bv 64 0x10)) (bv 64 0x9c4)) +a "mov dword ptr [rax+0x6c],0x1000" c7406c00100000 0x0 (storew 0 (+ (var rax) (bv 64 0x6c)) (bv 32 0x1000)) +a "mov dword ptr [rax+0xc0],0xa" c780c00000000a000000 0x0 (storew 0 (+ (var rax) (bv 64 0xc0)) (bv 32 0xa)) +a "mov qword ptr [rax+0x8],0x0" 48c7400800000000 0x0 (storew 0 (+ (var rax) (bv 64 0x8)) (bv 64 0x0)) +a "mov qword ptr [rax+0x20],0x1000" 48c7402000100000 0x0 (storew 0 (+ (var rax) (bv 64 0x20)) (bv 64 0x1000)) +a "mov qword ptr [rax],0x0" 48c70000000000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 64 0x0)) +a "mov dword ptr [rax+0x60],0x0" c7406000000000 0x0 (storew 0 (+ (var rax) (bv 64 0x60)) (bv 32 0x0)) +a "mov dword ptr [rax+0x38],0x0" c7403800000000 0x0 (storew 0 (+ (var rax) (bv 64 0x38)) (bv 32 0x0)) +a "mov qword ptr [rax+0x48],0x0" 48c7404800000000 0x0 (storew 0 (+ (var rax) (bv 64 0x48)) (bv 64 0x0)) +a "mov qword ptr [rax+0x50],0x1000" 48c7405000100000 0x0 (storew 0 (+ (var rax) (bv 64 0x50)) (bv 64 0x1000)) +a "mov qword ptr [rax],0x0" 48c70000000000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 64 0x0)) +a "mov qword ptr [rax+0x18],0x0" 48c7401800000000 0x0 (storew 0 (+ (var rax) (bv 64 0x18)) (bv 64 0x0)) +a "mov dword ptr [rax+0xc4],0x0" c780c400000000000000 0x0 (storew 0 (+ (var rax) (bv 64 0xc4)) (bv 32 0x0)) +a "mov qword ptr [rax+0x40],0x0" 48c7404000000000 0x0 (storew 0 (+ (var rax) (bv 64 0x40)) (bv 64 0x0)) +a "mov qword ptr [rax+0x8],0x0" 48c7400800000000 0x0 (storew 0 (+ (var rax) (bv 64 0x8)) (bv 64 0x0)) +a "mov qword ptr [rax],0x0" 48c70000000000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 64 0x0)) +a "mov qword ptr [rax+0x18],0x0" 48c7401800000000 0x0 (storew 0 (+ (var rax) (bv 64 0x18)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x8],0x0" c745f800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff8)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x4],0x0" c745fc00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffffc)) (bv 32 0x0)) +a "mov byte ptr [rbp-0xa],0x1" c645f601 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff6)) (bv 8 0x1)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov dword ptr [rbp-0x8],0x0" c745f800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff8)) (bv 32 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov qword ptr [rax+0x28],0x0" 48c7402800000000 0x0 (storew 0 (+ (var rax) (bv 64 0x28)) (bv 64 0x0)) +a "mov byte ptr [rax+0x4],0x0" c6400400 0x0 (storew 0 (+ (var rax) (bv 64 0x4)) (bv 8 0x0)) +a "mov byte ptr [rax+0x5],0x0" c6400500 0x0 (storew 0 (+ (var rax) (bv 64 0x5)) (bv 8 0x0)) +a "mov dword ptr [rax+0x8],0x1" c7400801000000 0x0 (storew 0 (+ (var rax) (bv 64 0x8)) (bv 32 0x1)) +a "mov byte ptr [rbp-0xa],0x0" c645f600 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff6)) (bv 8 0x0)) +a "mov qword ptr [rbp-0x20],0x0" 48c745e000000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe0)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x18],0x0" c745e800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe8)) (bv 32 0x0)) +a "mov qword ptr [rax+0x48],0x0" 48c7404800000000 0x0 (storew 0 (+ (var rax) (bv 64 0x48)) (bv 64 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov qword ptr [rax+0x48],0x0" 48c7404800000000 0x0 (storew 0 (+ (var rax) (bv 64 0x48)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x2c],0x0" c745d400000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffd4)) (bv 32 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov byte ptr [rax],0x24" c60024 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x24)) +a "mov qword ptr [rax+0x8],0x1" 48c7400801000000 0x0 (storew 0 (+ (var rax) (bv 64 0x8)) (bv 64 0x1)) +a "mov byte ptr [rax],0x7d" c6007d 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x7d)) +a "mov dword ptr [rbp-0x14],0x0" c745ec00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffec)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x14],0x22" c745ec22000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffec)) (bv 32 0x22)) +a "mov dword ptr [rbp-0x14],0x7e" c745ec7e000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffec)) (bv 32 0x7e)) +a "mov byte ptr [rax],0x2a" c6002a 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x2a)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov qword ptr [rbp-0x18],0x0" 48c745e800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe8)) (bv 64 0x0)) +a "mov dword ptr [rax+0xc4],0x1" c780c400000001000000 0x0 (storew 0 (+ (var rax) (bv 64 0xc4)) (bv 32 0x1)) +a "mov dword ptr [rax+0xc4],0x1" c780c400000001000000 0x0 (storew 0 (+ (var rax) (bv 64 0xc4)) (bv 32 0x1)) +a "mov dword ptr [rax+0xc4],0x1" c780c400000001000000 0x0 (storew 0 (+ (var rax) (bv 64 0xc4)) (bv 32 0x1)) +a "mov byte ptr [rbp-0x1],0x0" c645ff00 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffff)) (bv 8 0x0)) +a "mov qword ptr [rbp-0x8],0x0" 48c745f800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff8)) (bv 64 0x0)) +a "mov qword ptr [rbp-0x8],0x0" 48c745f800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff8)) (bv 64 0x0)) +a "mov dword ptr [rbp-0x8],0x0" c745f800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xfffffffffffffff8)) (bv 32 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov dword ptr [rbp-0x1c],0x0" c745e400000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe4)) (bv 32 0x0)) +a "mov dword ptr [rbp-0x18],0x0" c745e800000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffffe8)) (bv 32 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov dword ptr [rbp-0x84],0x0" c7857cffffff00000000 0x0 (storew 0 (+ (var rbp) (bv 64 0xffffffffffffff7c)) (bv 32 0x0)) +a "mov byte ptr [rax],0x0" c60000 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 8 0x0)) +a "mov dword ptr [rax],0xffffffff" c700ffffffff 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 32 0xffffffff)) +a "mov dword ptr [rax],0xffffffff" c700ffffffff 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 32 0xffffffff)) +a "mov dword ptr [rax],0xffffffff" c700ffffffff 0x0 (storew 0 (+ (var rax) (bv 64 0x0)) (bv 32 0xffffffff)) +a "mov dword ptr [esp+0x1c],0xc6670001" 67c744241c010067c6 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsp))) (bv 64 0x1c)) (bv 32 0xc6670001)) +a "mov byte ptr [esi],0x86" 67c60686 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsi))) (bv 64 0x0)) (bv 8 0x86)) +a "mov word ptr [esi],0x4020" 6766c7062040 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsi))) (bv 64 0x0)) (bv 16 0x4020)) +a "mov word ptr [esi],0x4020" 6766c7062040 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsi))) (bv 64 0x0)) (bv 16 0x4020)) +a "mov dword ptr [esi],0x404020" 67c70620404000 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsi))) (bv 64 0x0)) (bv 32 0x404020)) +a "mov byte ptr [esp+0x25],0xc0" 67c6442425c0 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsp))) (bv 64 0x25)) (bv 8 0xc0)) +a "mov dword ptr [esp+0x20],0x66670014" 67c744242014006766 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsp))) (bv 64 0x20)) (bv 32 0x66670014)) +a "mov dword ptr [esp+0x1c],0x534d4150" 67c744241c50414d53 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsp))) (bv 64 0x1c)) (bv 32 0x534d4150)) +a "mov dword ptr [edx],0x74000000" 67c70200000074 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rdx))) (bv 64 0x0)) (bv 32 0x74000000)) +a "mov dword ptr [eax+eax*1],0xa740000" 67c704000000740a 0x0 (storew 0 (+ (+ (cast 64 false (cast 32 false (var rax))) (* (cast 64 false (cast 32 false (var rax))) (bv 64 0x1))) (bv 64 0x0)) (bv 32 0xa740000)) +a "mov dword ptr [esp],0x1" 67c7042401000000 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsp))) (bv 64 0x0)) (bv 32 0x1)) +a "mov dword ptr [esp+0x4],0x0" 67c744240400000000 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsp))) (bv 64 0x4)) (bv 32 0x0)) +a "mov dword ptr [esp+0x4],0x0" 67c744240400000000 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsp))) (bv 64 0x4)) (bv 32 0x0)) +a "mov dword ptr [esi],0xb0003e04" 67c706043e00b0 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsi))) (bv 64 0x0)) (bv 32 0xb0003e04)) +a "mov dword ptr [esi],0xb8003e04" 67c706043e00b8 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsi))) (bv 64 0x0)) (bv 32 0xb8003e04)) +a "mov word ptr [esi],0x3d04" 6766c706043d 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsi))) (bv 64 0x0)) (bv 16 0x3d04)) +a "mov dword ptr [esp+0xc],0x3" 67c744240c03000000 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsp))) (bv 64 0xc)) (bv 32 0x3)) +a "mov dword ptr [esp+0xc],0x1" 67c744240c01000000 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsp))) (bv 64 0xc)) (bv 32 0x1)) +a "mov word ptr [esp+0x10],0x0" 6766c74424100000 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsp))) (bv 64 0x10)) (bv 16 0x0)) +a "mov word ptr [esp+0x14],0x0" 6766c74424140000 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsp))) (bv 64 0x14)) (bv 16 0x0)) +a "mov dword ptr [esp+0x24],0x66671a00" 67c7442424001a6766 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsp))) (bv 64 0x24)) (bv 32 0x66671a00)) +a "mov word ptr [esi],0x5078" 6766c7067850 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsi))) (bv 64 0x0)) (bv 16 0x5078)) +a "mov byte ptr [esi],0x7f" 67c6067f 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsi))) (bv 64 0x0)) (bv 8 0x7f)) +a "mov dword ptr [esi],0x15078" 67c70678500100 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsi))) (bv 64 0x0)) (bv 32 0x15078)) +a "mov word ptr [esi],0x5078" 6766c7067850 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsi))) (bv 64 0x0)) (bv 16 0x5078)) +a "mov dword ptr [esp+0x24],0x66670f00" 67c7442424000f6766 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsp))) (bv 64 0x24)) (bv 32 0x66670f00)) +a "mov word ptr [esi],0x5084" 6766c7068450 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rsi))) (bv 64 0x0)) (bv 16 0x5084)) +a "mov dword ptr [ebp-0x44],0x31660305" 67c745bc05036631 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rbp))) (bv 64 0xffffffffffffffbc)) (bv 32 0x31660305)) +a "mov dword ptr [ebp-0x4c],0x47534943" 67c745b443495347 0x0 (storew 0 (+ (cast 64 false (cast 32 false (var rbp))) (bv 64 0xffffffffffffffb4)) (bv 32 0x47534943)) aB "mov rax, qword[r12]" 498b0424 aB "mov rax, qword[r13]" 498b4500 aB "mov rsp, qword[r12 - 0x12]" 498b6424ee aB "mov qword[r12], rsp" 49892424 aB "mov qword[r8 + 0x20], rax" 49894020 aB "mov r12, qword[r12]" 4d8b2424 -a "mov eax,r12d" 4489e0 +a "mov eax,r12d" 4489e0 0x0 (set rax (| (& (var rax) (~ (bv 64 0xffffffff))) (cast 64 false (cast 32 false (var r12))))) ad "movabs r12, 1" 49bc0100000000000000 -a "inc al" fec0 -a "inc BYTE PTR [r12]" 41fe0424 -a "inc BYTE PTR [rbx+0x18]" fe4318 -a "inc BYTE PTR [rdi+0x18]" fe4718 -a "inc BYTE PTR [rsi+0x1a]" fe461a -a "inc cl" fec1 -a "inc dl" fec2 -a "inc DWORD PTR [r12]" 41ff0424 -a "inc DWORD PTR [r12+0x28]" 41ff442428 -a "inc DWORD PTR [r13+0x70]" 41ff4570 -a "inc DWORD PTR [r14]" 41ff06 -a "inc DWORD PTR [r14+0x134]" 41ff8634010000 -a "inc DWORD PTR [r15]" 41ff07 -a "inc DWORD PTR [r15+0x88]" 41ff8788000000 -a "inc DWORD PTR [rax]" ff00 -a "inc DWORD PTR [rax+0x14c]" ff804c010000 -a "inc DWORD PTR [rax+rdx*1]" ff0410 -a "inc DWORD PTR [rax+rdx*1+0x109]" ff841009010000 -a "inc DWORD PTR [rbp+0x10]" ff4510 -a "inc DWORD PTR [rbx]" ff03 -a "inc DWORD PTR [rbx+0x18]" ff4318 -a "inc DWORD PTR [rbx+0x20]" ff4320 -a "inc DWORD PTR [rcx]" ff01 -a "inc DWORD PTR [rcx+0x4]" ff4104 -a "inc DWORD PTR [rdi]" ff07 -a "inc DWORD PTR [rdi+0x28]" ff4728 -a "inc DWORD PTR [rdx]" ff02 -a "inc DWORD PTR [rdx+0x10]" ff4210 -a "inc DWORD PTR [rdx+rax*1]" ff0402 -a "inc DWORD PTR [rip+0x2009c8]" ff05c8092000 -a "inc DWORD PTR [rsi+0x8]" ff4608 -a "inc DWORD PTR [rsp]" ff0424 -a "inc DWORD PTR [rsp+0x10]" ff442410 -a "inc DWORD PTR [rsp+rax*4+0x400]" ff848400040000 -a "inc DWORD PTR [rsp+rbp*4+0x2b8]" ff84acb8020000 -a "inc eax" ffc0 -a "inc ebp" ffc5 -a "inc ebx" ffc3 -a "inc ecx" ffc1 -a "inc edi" ffc7 -a "inc edx" ffc2 -a "inc QWORD PTR [r10]" 49ff02 -a "inc QWORD PTR [r10+rax*1]" 49ff0402 -a "inc QWORD PTR [r11]" 49ff03 -a "inc QWORD PTR [r11+0x18]" 49ff4318 -a "inc QWORD PTR [r12]" 49ff0424 -a "inc QWORD PTR [r12+0x20]" 49ff442420 -a "inc QWORD PTR [r13+0x0]" 49ff4500 -a "inc QWORD PTR [r14]" 49ff06 -a "inc QWORD PTR [r14+0x20]" 49ff4620 -a "inc QWORD PTR [r15]" 49ff07 -a "inc QWORD PTR [r8]" 49ff00 -a "inc QWORD PTR [r9]" 49ff01 -a "inc QWORD PTR [rax]" 48ff00 -a "inc QWORD PTR [rax+0x20]" 48ff4020 -a "inc QWORD PTR [rax-0x8]" 48ff40f8 -a "inc QWORD PTR [rbp+0xb0]" 48ff85b0000000 -a "inc QWORD PTR [rbx]" 48ff03 -a "inc QWORD PTR [rbx+0x138]" 48ff8338010000 -a "inc QWORD PTR [rcx]" 48ff01 -a "inc QWORD PTR [rcx+0x8]" 48ff4108 -a "inc QWORD PTR [rdi]" 48ff07 -a "inc QWORD PTR [rdi+0x10]" 48ff4710 -a "inc QWORD PTR [rdi+rax*1+0xe1]" 48ff8407e1000000 -a "inc QWORD PTR [rdx]" 48ff02 -a "inc QWORD PTR [rdx+0x10]" 48ff4210 -a "inc QWORD PTR [rip+0x2121a1]" 48ff05a1212100 -a "inc QWORD PTR [rsi]" 48ff06 -a "inc QWORD PTR [rsp]" 48ff0424 -a "inc QWORD PTR [rsp+0x1b8]" 48ff8424b8010000 -a "inc r10" 49ffc2 -a "inc r10d" 41ffc2 -a "inc r11" 49ffc3 -a "inc r11d" 41ffc3 -a "inc r12" 49ffc4 -a "inc r12d" 41ffc4 -a "inc r13" 49ffc5 -a "inc r13d" 41ffc5 -a "inc r14" 49ffc6 -a "inc r14d" 41ffc6 -a "inc r15" 49ffc7 -a "inc r15d" 41ffc7 -a "inc r8" 49ffc0 -a "inc r8d" 41ffc0 -a "inc r9" 49ffc1 -a "inc r9d" 41ffc1 -a "inc rax" 48ffc0 -a "inc rbp" 48ffc5 -a "inc rbx" 48ffc3 -a "inc rcx" 48ffc1 -a "inc rdi" 48ffc7 -a "inc rdx" 48ffc2 -a "inc rsi" 48ffc6 -a "inc WORD PTR [rdi+0x88]" 66ff8788000000 -a "dec al" fec8 -a "dec BYTE PTR [r12]" 41fe0c24 -a "dec BYTE PTR [rbx+0x18]" fe4b18 -a "dec BYTE PTR [rdi+0x18]" fe4f18 -a "dec BYTE PTR [rsi+0x1a]" fe4e1a -a "dec cl" fec9 -a "dec dl" feca -a "dec DWORD PTR [r12]" 41ff0c24 -a "dec DWORD PTR [r12+0x28]" 41ff4c2428 -a "dec DWORD PTR [r13+0x70]" 41ff4d70 -a "dec DWORD PTR [r14]" 41ff0e -a "dec DWORD PTR [r14+0x134]" 41ff8e34010000 -a "dec DWORD PTR [r15]" 41ff0f -a "dec DWORD PTR [r15+0x88]" 41ff8f88000000 -a "dec DWORD PTR [rax]" ff08 -a "dec DWORD PTR [rax+0x14c]" ff884c010000 -a "dec DWORD PTR [rax+rdx*1]" ff0c10 -a "dec DWORD PTR [rax+rdx*1+0x109]" ff8c1009010000 -a "dec DWORD PTR [rbp+0x10]" ff4d10 -a "dec DWORD PTR [rbx]" ff0b -a "dec DWORD PTR [rbx+0x18]" ff4b18 -a "dec DWORD PTR [rbx+0x20]" ff4b20 -a "dec DWORD PTR [rcx]" ff09 -a "dec DWORD PTR [rcx+0x4]" ff4904 -a "dec DWORD PTR [rdi]" ff0f -a "dec DWORD PTR [rdi+0x28]" ff4f28 -a "dec DWORD PTR [rdx]" ff0a -a "dec DWORD PTR [rdx+0x10]" ff4a10 -a "dec DWORD PTR [rdx+rax*1]" ff0c02 -a "dec DWORD PTR [rip+0x2009c8]" ff0dc8092000 -a "dec DWORD PTR [rsi+0x8]" ff4e08 -a "dec DWORD PTR [rsp]" ff0c24 -a "dec DWORD PTR [rsp+0x10]" ff4c2410 -a "dec DWORD PTR [rsp+rax*4+0x400]" ff8c8400040000 -a "dec DWORD PTR [rsp+rbp*4+0x2b8]" ff8cacb8020000 -a "dec eax" ffc8 -a "dec ebp" ffcd -a "dec ebx" ffcb -a "dec ecx" ffc9 -a "dec edi" ffcf -a "dec edx" ffca -a "dec QWORD PTR [r10]" 49ff0a -a "dec QWORD PTR [r10+rax*1]" 49ff0c02 -a "dec QWORD PTR [r11]" 49ff0b -a "dec QWORD PTR [r11+0x18]" 49ff4b18 -a "dec QWORD PTR [r12]" 49ff0c24 -a "dec QWORD PTR [r12+0x20]" 49ff4c2420 -a "dec QWORD PTR [r13+0x0]" 49ff4d00 -a "dec QWORD PTR [r14]" 49ff0e -a "dec QWORD PTR [r14+0x20]" 49ff4e20 -a "dec QWORD PTR [r15]" 49ff0f -a "dec QWORD PTR [r8]" 49ff08 -a "dec QWORD PTR [r9]" 49ff09 -a "dec QWORD PTR [rax]" 48ff08 -a "dec QWORD PTR [rax+0x20]" 48ff4820 -a "dec QWORD PTR [rax-0x8]" 48ff48f8 -a "dec QWORD PTR [rbp+0xb0]" 48ff8db0000000 -a "dec QWORD PTR [rbx]" 48ff0b -a "dec QWORD PTR [rbx+0x138]" 48ff8b38010000 -a "dec QWORD PTR [rcx]" 48ff09 -a "dec QWORD PTR [rcx+0x8]" 48ff4908 -a "dec QWORD PTR [rdi]" 48ff0f -a "dec QWORD PTR [rdi+0x10]" 48ff4f10 -a "dec QWORD PTR [rdi+rax*1+0xe1]" 48ff8c07e1000000 -a "dec QWORD PTR [rdx]" 48ff0a -a "dec QWORD PTR [rdx+0x10]" 48ff4a10 -a "dec QWORD PTR [rip+0x2121a1]" 48ff0da1212100 -a "dec QWORD PTR [rsi]" 48ff0e -a "dec QWORD PTR [rsp]" 48ff0c24 -a "dec QWORD PTR [rsp+0x1b8]" 48ff8c24b8010000 -a "dec r10" 49ffca -a "dec r10d" 41ffca -a "dec r11" 49ffcb -a "dec r11d" 41ffcb -a "dec r12" 49ffcc -a "dec r12d" 41ffcc -a "dec r13" 49ffcd -a "dec r13d" 41ffcd -a "dec r14" 49ffce -a "dec r14d" 41ffce -a "dec r15" 49ffcf -a "dec r15d" 41ffcf -a "dec r8" 49ffc8 -a "dec r8d" 41ffc8 -a "dec r9" 49ffc9 -a "dec r9d" 41ffc9 -a "dec rax" 48ffc8 -a "dec rbp" 48ffcd -a "dec rbx" 48ffcb -a "dec rcx" 48ffc9 -a "dec rdi" 48ffcf -a "dec rdx" 48ffca -a "dec rsi" 48ffce -a "dec WORD PTR [rdi+0x88]" 66ff8f88000000 +a "inc al" fec0 0x0 (seq (set _op (cast 8 false (var rax))) (set _result (+ (var _op) (bv 8 0x1))) (set rax (| (& (var rax) (~ (bv 64 0xff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc BYTE PTR [r12]" 41fe0424 0x0 (seq (set _op (loadw 0 8 (+ (cast 64 false (var r12)) (bv 64 0x0)))) (set _result (+ (var _op) (bv 8 0x1))) (storew 0 (+ (cast 64 false (var r12)) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc BYTE PTR [rbx+0x18]" fe4318 0x0 (seq (set _op (loadw 0 8 (+ (var rbx) (bv 64 0x18)))) (set _result (+ (var _op) (bv 8 0x1))) (storew 0 (+ (var rbx) (bv 64 0x18)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc BYTE PTR [rdi+0x18]" fe4718 0x0 (seq (set _op (loadw 0 8 (+ (var rdi) (bv 64 0x18)))) (set _result (+ (var _op) (bv 8 0x1))) (storew 0 (+ (var rdi) (bv 64 0x18)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc BYTE PTR [rsi+0x1a]" fe461a 0x0 (seq (set _op (loadw 0 8 (+ (var rsi) (bv 64 0x1a)))) (set _result (+ (var _op) (bv 8 0x1))) (storew 0 (+ (var rsi) (bv 64 0x1a)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc cl" fec1 0x0 (seq (set _op (cast 8 false (var rcx))) (set _result (+ (var _op) (bv 8 0x1))) (set rcx (| (& (var rcx) (~ (bv 64 0xff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc dl" fec2 0x0 (seq (set _op (cast 8 false (var rdx))) (set _result (+ (var _op) (bv 8 0x1))) (set rdx (| (& (var rdx) (~ (bv 64 0xff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [r12]" 41ff0424 0x0 (seq (set _op (loadw 0 32 (+ (cast 64 false (var r12)) (bv 64 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (cast 64 false (var r12)) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [r12+0x28]" 41ff442428 0x0 (seq (set _op (loadw 0 32 (+ (cast 64 false (var r12)) (bv 64 0x28)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (cast 64 false (var r12)) (bv 64 0x28)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [r13+0x70]" 41ff4570 0x0 (seq (set _op (loadw 0 32 (+ (cast 64 false (var r13)) (bv 64 0x70)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (cast 64 false (var r13)) (bv 64 0x70)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [r14]" 41ff06 0x0 (seq (set _op (loadw 0 32 (+ (cast 64 false (var r14)) (bv 64 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (cast 64 false (var r14)) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [r14+0x134]" 41ff8634010000 0x0 (seq (set _op (loadw 0 32 (+ (cast 64 false (var r14)) (bv 64 0x134)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (cast 64 false (var r14)) (bv 64 0x134)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [r15]" 41ff07 0x0 (seq (set _op (loadw 0 32 (+ (cast 64 false (var r15)) (bv 64 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (cast 64 false (var r15)) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [r15+0x88]" 41ff8788000000 0x0 (seq (set _op (loadw 0 32 (+ (cast 64 false (var r15)) (bv 64 0x88)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (cast 64 false (var r15)) (bv 64 0x88)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rax]" ff00 0x0 (seq (set _op (loadw 0 32 (+ (var rax) (bv 64 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var rax) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rax+0x14c]" ff804c010000 0x0 (seq (set _op (loadw 0 32 (+ (var rax) (bv 64 0x14c)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var rax) (bv 64 0x14c)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rax+rdx*1]" ff0410 0x0 (seq (set _op (loadw 0 32 (+ (+ (var rax) (* (var rdx) (bv 64 0x1))) (bv 64 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (+ (var rax) (* (var rdx) (bv 64 0x1))) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rax+rdx*1+0x109]" ff841009010000 0x0 (seq (set _op (loadw 0 32 (+ (+ (var rax) (* (var rdx) (bv 64 0x1))) (bv 64 0x109)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (+ (var rax) (* (var rdx) (bv 64 0x1))) (bv 64 0x109)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rbp+0x10]" ff4510 0x0 (seq (set _op (loadw 0 32 (+ (var rbp) (bv 64 0x10)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var rbp) (bv 64 0x10)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rbx]" ff03 0x0 (seq (set _op (loadw 0 32 (+ (var rbx) (bv 64 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var rbx) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rbx+0x18]" ff4318 0x0 (seq (set _op (loadw 0 32 (+ (var rbx) (bv 64 0x18)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var rbx) (bv 64 0x18)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rbx+0x20]" ff4320 0x0 (seq (set _op (loadw 0 32 (+ (var rbx) (bv 64 0x20)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var rbx) (bv 64 0x20)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rcx]" ff01 0x0 (seq (set _op (loadw 0 32 (+ (var rcx) (bv 64 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var rcx) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rcx+0x4]" ff4104 0x0 (seq (set _op (loadw 0 32 (+ (var rcx) (bv 64 0x4)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var rcx) (bv 64 0x4)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rdi]" ff07 0x0 (seq (set _op (loadw 0 32 (+ (var rdi) (bv 64 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var rdi) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rdi+0x28]" ff4728 0x0 (seq (set _op (loadw 0 32 (+ (var rdi) (bv 64 0x28)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var rdi) (bv 64 0x28)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rdx]" ff02 0x0 (seq (set _op (loadw 0 32 (+ (var rdx) (bv 64 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var rdx) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rdx+0x10]" ff4210 0x0 (seq (set _op (loadw 0 32 (+ (var rdx) (bv 64 0x10)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var rdx) (bv 64 0x10)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rdx+rax*1]" ff0402 0x0 (seq (set _op (loadw 0 32 (+ (+ (var rdx) (* (var rax) (bv 64 0x1))) (bv 64 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (+ (var rdx) (* (var rax) (bv 64 0x1))) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rip+0x2009c8]" ff05c8092000 0x0 (seq (set _op (loadw 0 32 (+ (bv 64 0x0) (bv 64 0x2009c8)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (bv 64 0x0) (bv 64 0x2009c8)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rsi+0x8]" ff4608 0x0 (seq (set _op (loadw 0 32 (+ (var rsi) (bv 64 0x8)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var rsi) (bv 64 0x8)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rsp]" ff0424 0x0 (seq (set _op (loadw 0 32 (+ (var rsp) (bv 64 0x0)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var rsp) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rsp+0x10]" ff442410 0x0 (seq (set _op (loadw 0 32 (+ (var rsp) (bv 64 0x10)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (var rsp) (bv 64 0x10)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rsp+rax*4+0x400]" ff848400040000 0x0 (seq (set _op (loadw 0 32 (+ (+ (var rsp) (* (var rax) (bv 64 0x4))) (bv 64 0x400)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (+ (var rsp) (* (var rax) (bv 64 0x4))) (bv 64 0x400)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc DWORD PTR [rsp+rbp*4+0x2b8]" ff84acb8020000 0x0 (seq (set _op (loadw 0 32 (+ (+ (var rsp) (* (var rbp) (bv 64 0x4))) (bv 64 0x2b8)))) (set _result (+ (var _op) (bv 32 0x1))) (storew 0 (+ (+ (var rsp) (* (var rbp) (bv 64 0x4))) (bv 64 0x2b8)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc eax" ffc0 0x0 (seq (set _op (cast 32 false (var rax))) (set _result (+ (var _op) (bv 32 0x1))) (set rax (| (& (var rax) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc ebp" ffc5 0x0 (seq (set _op (cast 32 false (var rbp))) (set _result (+ (var _op) (bv 32 0x1))) (set rbp (| (& (var rbp) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc ebx" ffc3 0x0 (seq (set _op (cast 32 false (var rbx))) (set _result (+ (var _op) (bv 32 0x1))) (set rbx (| (& (var rbx) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc ecx" ffc1 0x0 (seq (set _op (cast 32 false (var rcx))) (set _result (+ (var _op) (bv 32 0x1))) (set rcx (| (& (var rcx) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc edi" ffc7 0x0 (seq (set _op (cast 32 false (var rdi))) (set _result (+ (var _op) (bv 32 0x1))) (set rdi (| (& (var rdi) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc edx" ffc2 0x0 (seq (set _op (cast 32 false (var rdx))) (set _result (+ (var _op) (bv 32 0x1))) (set rdx (| (& (var rdx) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [r10]" 49ff02 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r10)) (bv 64 0x0)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r10)) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [r10+rax*1]" 49ff0402 0x0 (seq (set _op (loadw 0 64 (+ (+ (cast 64 false (var r10)) (* (var rax) (bv 64 0x1))) (bv 64 0x0)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (+ (cast 64 false (var r10)) (* (var rax) (bv 64 0x1))) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [r11]" 49ff03 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r11)) (bv 64 0x0)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r11)) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [r11+0x18]" 49ff4318 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r11)) (bv 64 0x18)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r11)) (bv 64 0x18)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [r12]" 49ff0424 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r12)) (bv 64 0x0)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r12)) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [r12+0x20]" 49ff442420 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r12)) (bv 64 0x20)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r12)) (bv 64 0x20)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [r13+0x0]" 49ff4500 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r13)) (bv 64 0x0)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r13)) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [r14]" 49ff06 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r14)) (bv 64 0x0)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r14)) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [r14+0x20]" 49ff4620 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r14)) (bv 64 0x20)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r14)) (bv 64 0x20)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [r15]" 49ff07 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r15)) (bv 64 0x0)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r15)) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [r8]" 49ff00 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r8)) (bv 64 0x0)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r8)) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [r9]" 49ff01 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r9)) (bv 64 0x0)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r9)) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [rax]" 48ff00 0x0 (seq (set _op (loadw 0 64 (+ (var rax) (bv 64 0x0)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (var rax) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [rax+0x20]" 48ff4020 0x0 (seq (set _op (loadw 0 64 (+ (var rax) (bv 64 0x20)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (var rax) (bv 64 0x20)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [rax-0x8]" 48ff40f8 0x0 (seq (set _op (loadw 0 64 (+ (var rax) (bv 64 0xfffffffffffffff8)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (var rax) (bv 64 0xfffffffffffffff8)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [rbp+0xb0]" 48ff85b0000000 0x0 (seq (set _op (loadw 0 64 (+ (var rbp) (bv 64 0xb0)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (var rbp) (bv 64 0xb0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [rbx]" 48ff03 0x0 (seq (set _op (loadw 0 64 (+ (var rbx) (bv 64 0x0)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (var rbx) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [rbx+0x138]" 48ff8338010000 0x0 (seq (set _op (loadw 0 64 (+ (var rbx) (bv 64 0x138)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (var rbx) (bv 64 0x138)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [rcx]" 48ff01 0x0 (seq (set _op (loadw 0 64 (+ (var rcx) (bv 64 0x0)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (var rcx) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [rcx+0x8]" 48ff4108 0x0 (seq (set _op (loadw 0 64 (+ (var rcx) (bv 64 0x8)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (var rcx) (bv 64 0x8)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [rdi]" 48ff07 0x0 (seq (set _op (loadw 0 64 (+ (var rdi) (bv 64 0x0)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (var rdi) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [rdi+0x10]" 48ff4710 0x0 (seq (set _op (loadw 0 64 (+ (var rdi) (bv 64 0x10)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (var rdi) (bv 64 0x10)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [rdi+rax*1+0xe1]" 48ff8407e1000000 0x0 (seq (set _op (loadw 0 64 (+ (+ (var rdi) (* (var rax) (bv 64 0x1))) (bv 64 0xe1)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (+ (var rdi) (* (var rax) (bv 64 0x1))) (bv 64 0xe1)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [rdx]" 48ff02 0x0 (seq (set _op (loadw 0 64 (+ (var rdx) (bv 64 0x0)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (var rdx) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [rdx+0x10]" 48ff4210 0x0 (seq (set _op (loadw 0 64 (+ (var rdx) (bv 64 0x10)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (var rdx) (bv 64 0x10)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [rip+0x2121a1]" 48ff05a1212100 0x0 (seq (set _op (loadw 0 64 (+ (bv 64 0x0) (bv 64 0x2121a1)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (bv 64 0x0) (bv 64 0x2121a1)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [rsi]" 48ff06 0x0 (seq (set _op (loadw 0 64 (+ (var rsi) (bv 64 0x0)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (var rsi) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [rsp]" 48ff0424 0x0 (seq (set _op (loadw 0 64 (+ (var rsp) (bv 64 0x0)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (var rsp) (bv 64 0x0)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc QWORD PTR [rsp+0x1b8]" 48ff8424b8010000 0x0 (seq (set _op (loadw 0 64 (+ (var rsp) (bv 64 0x1b8)))) (set _result (+ (var _op) (bv 64 0x1))) (storew 0 (+ (var rsp) (bv 64 0x1b8)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc r10" 49ffc2 0x0 (seq (set _op (var r10)) (set _result (+ (var _op) (bv 64 0x1))) (set r10 (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc r10d" 41ffc2 0x0 (seq (set _op (cast 32 false (var r10))) (set _result (+ (var _op) (bv 32 0x1))) (set r10 (| (& (var r10) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc r11" 49ffc3 0x0 (seq (set _op (var r11)) (set _result (+ (var _op) (bv 64 0x1))) (set r11 (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc r11d" 41ffc3 0x0 (seq (set _op (cast 32 false (var r11))) (set _result (+ (var _op) (bv 32 0x1))) (set r11 (| (& (var r11) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc r12" 49ffc4 0x0 (seq (set _op (var r12)) (set _result (+ (var _op) (bv 64 0x1))) (set r12 (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc r12d" 41ffc4 0x0 (seq (set _op (cast 32 false (var r12))) (set _result (+ (var _op) (bv 32 0x1))) (set r12 (| (& (var r12) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc r13" 49ffc5 0x0 (seq (set _op (var r13)) (set _result (+ (var _op) (bv 64 0x1))) (set r13 (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc r13d" 41ffc5 0x0 (seq (set _op (cast 32 false (var r13))) (set _result (+ (var _op) (bv 32 0x1))) (set r13 (| (& (var r13) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc r14" 49ffc6 0x0 (seq (set _op (var r14)) (set _result (+ (var _op) (bv 64 0x1))) (set r14 (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc r14d" 41ffc6 0x0 (seq (set _op (cast 32 false (var r14))) (set _result (+ (var _op) (bv 32 0x1))) (set r14 (| (& (var r14) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc r15" 49ffc7 0x0 (seq (set _op (var r15)) (set _result (+ (var _op) (bv 64 0x1))) (set r15 (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc r15d" 41ffc7 0x0 (seq (set _op (cast 32 false (var r15))) (set _result (+ (var _op) (bv 32 0x1))) (set r15 (| (& (var r15) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc r8" 49ffc0 0x0 (seq (set _op (var r8)) (set _result (+ (var _op) (bv 64 0x1))) (set r8 (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc r8d" 41ffc0 0x0 (seq (set _op (cast 32 false (var r8))) (set _result (+ (var _op) (bv 32 0x1))) (set r8 (| (& (var r8) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc r9" 49ffc1 0x0 (seq (set _op (var r9)) (set _result (+ (var _op) (bv 64 0x1))) (set r9 (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc r9d" 41ffc1 0x0 (seq (set _op (cast 32 false (var r9))) (set _result (+ (var _op) (bv 32 0x1))) (set r9 (| (& (var r9) (~ (bv 64 0xffffffff))) (cast 64 false (var _result)))) (set _result (var _result)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc rax" 48ffc0 0x0 (seq (set _op (var rax)) (set _result (+ (var _op) (bv 64 0x1))) (set rax (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc rbp" 48ffc5 0x0 (seq (set _op (var rbp)) (set _result (+ (var _op) (bv 64 0x1))) (set rbp (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc rbx" 48ffc3 0x0 (seq (set _op (var rbx)) (set _result (+ (var _op) (bv 64 0x1))) (set rbx (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc rcx" 48ffc1 0x0 (seq (set _op (var rcx)) (set _result (+ (var _op) (bv 64 0x1))) (set rcx (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc rdi" 48ffc7 0x0 (seq (set _op (var rdi)) (set _result (+ (var _op) (bv 64 0x1))) (set rdi (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc rdx" 48ffc2 0x0 (seq (set _op (var rdx)) (set _result (+ (var _op) (bv 64 0x1))) (set rdx (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc rsi" 48ffc6 0x0 (seq (set _op (var rsi)) (set _result (+ (var _op) (bv 64 0x1))) (set rsi (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "inc WORD PTR [rdi+0x88]" 66ff8788000000 0x0 (seq (set _op (loadw 0 16 (+ (var rdi) (bv 64 0x88)))) (set _result (+ (var _op) (bv 16 0x1))) (storew 0 (+ (var rdi) (bv 64 0x88)) (var _result)) (set _result (var _result)) (set _x (var _op)) (set _y (bv 16 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (msb (var _y))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (! (msb (var _y)))))) (set af (|| (|| (&& (msb (cast 4 false (var _x))) (msb (cast 4 false (var _y)))) (&& (! (msb (cast 4 false (var _result)))) (msb (cast 4 false (var _y))))) (&& (msb (cast 4 false (var _x))) (! (msb (cast 4 false (var _result))))))) (set _result (var _result)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result)))) +a "dec al" fec8 0x0 (seq (set _op (cast 8 false (var rax))) (set _dec (- (var _op) (bv 8 0x1))) (set rax (| (& (var rax) (~ (bv 64 0xff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec BYTE PTR [r12]" 41fe0c24 0x0 (seq (set _op (loadw 0 8 (+ (cast 64 false (var r12)) (bv 64 0x0)))) (set _dec (- (var _op) (bv 8 0x1))) (storew 0 (+ (cast 64 false (var r12)) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec BYTE PTR [rbx+0x18]" fe4b18 0x0 (seq (set _op (loadw 0 8 (+ (var rbx) (bv 64 0x18)))) (set _dec (- (var _op) (bv 8 0x1))) (storew 0 (+ (var rbx) (bv 64 0x18)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec BYTE PTR [rdi+0x18]" fe4f18 0x0 (seq (set _op (loadw 0 8 (+ (var rdi) (bv 64 0x18)))) (set _dec (- (var _op) (bv 8 0x1))) (storew 0 (+ (var rdi) (bv 64 0x18)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec BYTE PTR [rsi+0x1a]" fe4e1a 0x0 (seq (set _op (loadw 0 8 (+ (var rsi) (bv 64 0x1a)))) (set _dec (- (var _op) (bv 8 0x1))) (storew 0 (+ (var rsi) (bv 64 0x1a)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec cl" fec9 0x0 (seq (set _op (cast 8 false (var rcx))) (set _dec (- (var _op) (bv 8 0x1))) (set rcx (| (& (var rcx) (~ (bv 64 0xff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec dl" feca 0x0 (seq (set _op (cast 8 false (var rdx))) (set _dec (- (var _op) (bv 8 0x1))) (set rdx (| (& (var rdx) (~ (bv 64 0xff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 8 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [r12]" 41ff0c24 0x0 (seq (set _op (loadw 0 32 (+ (cast 64 false (var r12)) (bv 64 0x0)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (cast 64 false (var r12)) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [r12+0x28]" 41ff4c2428 0x0 (seq (set _op (loadw 0 32 (+ (cast 64 false (var r12)) (bv 64 0x28)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (cast 64 false (var r12)) (bv 64 0x28)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [r13+0x70]" 41ff4d70 0x0 (seq (set _op (loadw 0 32 (+ (cast 64 false (var r13)) (bv 64 0x70)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (cast 64 false (var r13)) (bv 64 0x70)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [r14]" 41ff0e 0x0 (seq (set _op (loadw 0 32 (+ (cast 64 false (var r14)) (bv 64 0x0)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (cast 64 false (var r14)) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [r14+0x134]" 41ff8e34010000 0x0 (seq (set _op (loadw 0 32 (+ (cast 64 false (var r14)) (bv 64 0x134)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (cast 64 false (var r14)) (bv 64 0x134)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [r15]" 41ff0f 0x0 (seq (set _op (loadw 0 32 (+ (cast 64 false (var r15)) (bv 64 0x0)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (cast 64 false (var r15)) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [r15+0x88]" 41ff8f88000000 0x0 (seq (set _op (loadw 0 32 (+ (cast 64 false (var r15)) (bv 64 0x88)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (cast 64 false (var r15)) (bv 64 0x88)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rax]" ff08 0x0 (seq (set _op (loadw 0 32 (+ (var rax) (bv 64 0x0)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var rax) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rax+0x14c]" ff884c010000 0x0 (seq (set _op (loadw 0 32 (+ (var rax) (bv 64 0x14c)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var rax) (bv 64 0x14c)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rax+rdx*1]" ff0c10 0x0 (seq (set _op (loadw 0 32 (+ (+ (var rax) (* (var rdx) (bv 64 0x1))) (bv 64 0x0)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (+ (var rax) (* (var rdx) (bv 64 0x1))) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rax+rdx*1+0x109]" ff8c1009010000 0x0 (seq (set _op (loadw 0 32 (+ (+ (var rax) (* (var rdx) (bv 64 0x1))) (bv 64 0x109)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (+ (var rax) (* (var rdx) (bv 64 0x1))) (bv 64 0x109)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rbp+0x10]" ff4d10 0x0 (seq (set _op (loadw 0 32 (+ (var rbp) (bv 64 0x10)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var rbp) (bv 64 0x10)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rbx]" ff0b 0x0 (seq (set _op (loadw 0 32 (+ (var rbx) (bv 64 0x0)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var rbx) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rbx+0x18]" ff4b18 0x0 (seq (set _op (loadw 0 32 (+ (var rbx) (bv 64 0x18)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var rbx) (bv 64 0x18)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rbx+0x20]" ff4b20 0x0 (seq (set _op (loadw 0 32 (+ (var rbx) (bv 64 0x20)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var rbx) (bv 64 0x20)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rcx]" ff09 0x0 (seq (set _op (loadw 0 32 (+ (var rcx) (bv 64 0x0)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var rcx) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rcx+0x4]" ff4904 0x0 (seq (set _op (loadw 0 32 (+ (var rcx) (bv 64 0x4)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var rcx) (bv 64 0x4)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rdi]" ff0f 0x0 (seq (set _op (loadw 0 32 (+ (var rdi) (bv 64 0x0)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var rdi) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rdi+0x28]" ff4f28 0x0 (seq (set _op (loadw 0 32 (+ (var rdi) (bv 64 0x28)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var rdi) (bv 64 0x28)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rdx]" ff0a 0x0 (seq (set _op (loadw 0 32 (+ (var rdx) (bv 64 0x0)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var rdx) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rdx+0x10]" ff4a10 0x0 (seq (set _op (loadw 0 32 (+ (var rdx) (bv 64 0x10)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var rdx) (bv 64 0x10)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rdx+rax*1]" ff0c02 0x0 (seq (set _op (loadw 0 32 (+ (+ (var rdx) (* (var rax) (bv 64 0x1))) (bv 64 0x0)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (+ (var rdx) (* (var rax) (bv 64 0x1))) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rip+0x2009c8]" ff0dc8092000 0x0 (seq (set _op (loadw 0 32 (+ (bv 64 0x0) (bv 64 0x2009c8)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (bv 64 0x0) (bv 64 0x2009c8)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rsi+0x8]" ff4e08 0x0 (seq (set _op (loadw 0 32 (+ (var rsi) (bv 64 0x8)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var rsi) (bv 64 0x8)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rsp]" ff0c24 0x0 (seq (set _op (loadw 0 32 (+ (var rsp) (bv 64 0x0)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var rsp) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rsp+0x10]" ff4c2410 0x0 (seq (set _op (loadw 0 32 (+ (var rsp) (bv 64 0x10)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (var rsp) (bv 64 0x10)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rsp+rax*4+0x400]" ff8c8400040000 0x0 (seq (set _op (loadw 0 32 (+ (+ (var rsp) (* (var rax) (bv 64 0x4))) (bv 64 0x400)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (+ (var rsp) (* (var rax) (bv 64 0x4))) (bv 64 0x400)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec DWORD PTR [rsp+rbp*4+0x2b8]" ff8cacb8020000 0x0 (seq (set _op (loadw 0 32 (+ (+ (var rsp) (* (var rbp) (bv 64 0x4))) (bv 64 0x2b8)))) (set _dec (- (var _op) (bv 32 0x1))) (storew 0 (+ (+ (var rsp) (* (var rbp) (bv 64 0x4))) (bv 64 0x2b8)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec eax" ffc8 0x0 (seq (set _op (cast 32 false (var rax))) (set _dec (- (var _op) (bv 32 0x1))) (set rax (| (& (var rax) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec ebp" ffcd 0x0 (seq (set _op (cast 32 false (var rbp))) (set _dec (- (var _op) (bv 32 0x1))) (set rbp (| (& (var rbp) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec ebx" ffcb 0x0 (seq (set _op (cast 32 false (var rbx))) (set _dec (- (var _op) (bv 32 0x1))) (set rbx (| (& (var rbx) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec ecx" ffc9 0x0 (seq (set _op (cast 32 false (var rcx))) (set _dec (- (var _op) (bv 32 0x1))) (set rcx (| (& (var rcx) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec edi" ffcf 0x0 (seq (set _op (cast 32 false (var rdi))) (set _dec (- (var _op) (bv 32 0x1))) (set rdi (| (& (var rdi) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec edx" ffca 0x0 (seq (set _op (cast 32 false (var rdx))) (set _dec (- (var _op) (bv 32 0x1))) (set rdx (| (& (var rdx) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [r10]" 49ff0a 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r10)) (bv 64 0x0)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r10)) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [r10+rax*1]" 49ff0c02 0x0 (seq (set _op (loadw 0 64 (+ (+ (cast 64 false (var r10)) (* (var rax) (bv 64 0x1))) (bv 64 0x0)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (+ (cast 64 false (var r10)) (* (var rax) (bv 64 0x1))) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [r11]" 49ff0b 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r11)) (bv 64 0x0)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r11)) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [r11+0x18]" 49ff4b18 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r11)) (bv 64 0x18)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r11)) (bv 64 0x18)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [r12]" 49ff0c24 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r12)) (bv 64 0x0)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r12)) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [r12+0x20]" 49ff4c2420 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r12)) (bv 64 0x20)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r12)) (bv 64 0x20)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [r13+0x0]" 49ff4d00 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r13)) (bv 64 0x0)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r13)) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [r14]" 49ff0e 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r14)) (bv 64 0x0)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r14)) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [r14+0x20]" 49ff4e20 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r14)) (bv 64 0x20)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r14)) (bv 64 0x20)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [r15]" 49ff0f 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r15)) (bv 64 0x0)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r15)) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [r8]" 49ff08 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r8)) (bv 64 0x0)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r8)) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [r9]" 49ff09 0x0 (seq (set _op (loadw 0 64 (+ (cast 64 false (var r9)) (bv 64 0x0)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (cast 64 false (var r9)) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [rax]" 48ff08 0x0 (seq (set _op (loadw 0 64 (+ (var rax) (bv 64 0x0)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (var rax) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [rax+0x20]" 48ff4820 0x0 (seq (set _op (loadw 0 64 (+ (var rax) (bv 64 0x20)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (var rax) (bv 64 0x20)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [rax-0x8]" 48ff48f8 0x0 (seq (set _op (loadw 0 64 (+ (var rax) (bv 64 0xfffffffffffffff8)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (var rax) (bv 64 0xfffffffffffffff8)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [rbp+0xb0]" 48ff8db0000000 0x0 (seq (set _op (loadw 0 64 (+ (var rbp) (bv 64 0xb0)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (var rbp) (bv 64 0xb0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [rbx]" 48ff0b 0x0 (seq (set _op (loadw 0 64 (+ (var rbx) (bv 64 0x0)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (var rbx) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [rbx+0x138]" 48ff8b38010000 0x0 (seq (set _op (loadw 0 64 (+ (var rbx) (bv 64 0x138)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (var rbx) (bv 64 0x138)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [rcx]" 48ff09 0x0 (seq (set _op (loadw 0 64 (+ (var rcx) (bv 64 0x0)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (var rcx) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [rcx+0x8]" 48ff4908 0x0 (seq (set _op (loadw 0 64 (+ (var rcx) (bv 64 0x8)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (var rcx) (bv 64 0x8)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [rdi]" 48ff0f 0x0 (seq (set _op (loadw 0 64 (+ (var rdi) (bv 64 0x0)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (var rdi) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [rdi+0x10]" 48ff4f10 0x0 (seq (set _op (loadw 0 64 (+ (var rdi) (bv 64 0x10)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (var rdi) (bv 64 0x10)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [rdi+rax*1+0xe1]" 48ff8c07e1000000 0x0 (seq (set _op (loadw 0 64 (+ (+ (var rdi) (* (var rax) (bv 64 0x1))) (bv 64 0xe1)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (+ (var rdi) (* (var rax) (bv 64 0x1))) (bv 64 0xe1)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [rdx]" 48ff0a 0x0 (seq (set _op (loadw 0 64 (+ (var rdx) (bv 64 0x0)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (var rdx) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [rdx+0x10]" 48ff4a10 0x0 (seq (set _op (loadw 0 64 (+ (var rdx) (bv 64 0x10)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (var rdx) (bv 64 0x10)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [rip+0x2121a1]" 48ff0da1212100 0x0 (seq (set _op (loadw 0 64 (+ (bv 64 0x0) (bv 64 0x2121a1)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (bv 64 0x0) (bv 64 0x2121a1)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [rsi]" 48ff0e 0x0 (seq (set _op (loadw 0 64 (+ (var rsi) (bv 64 0x0)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (var rsi) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [rsp]" 48ff0c24 0x0 (seq (set _op (loadw 0 64 (+ (var rsp) (bv 64 0x0)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (var rsp) (bv 64 0x0)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec QWORD PTR [rsp+0x1b8]" 48ff8c24b8010000 0x0 (seq (set _op (loadw 0 64 (+ (var rsp) (bv 64 0x1b8)))) (set _dec (- (var _op) (bv 64 0x1))) (storew 0 (+ (var rsp) (bv 64 0x1b8)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec r10" 49ffca 0x0 (seq (set _op (var r10)) (set _dec (- (var _op) (bv 64 0x1))) (set r10 (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec r10d" 41ffca 0x0 (seq (set _op (cast 32 false (var r10))) (set _dec (- (var _op) (bv 32 0x1))) (set r10 (| (& (var r10) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec r11" 49ffcb 0x0 (seq (set _op (var r11)) (set _dec (- (var _op) (bv 64 0x1))) (set r11 (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec r11d" 41ffcb 0x0 (seq (set _op (cast 32 false (var r11))) (set _dec (- (var _op) (bv 32 0x1))) (set r11 (| (& (var r11) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec r12" 49ffcc 0x0 (seq (set _op (var r12)) (set _dec (- (var _op) (bv 64 0x1))) (set r12 (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec r12d" 41ffcc 0x0 (seq (set _op (cast 32 false (var r12))) (set _dec (- (var _op) (bv 32 0x1))) (set r12 (| (& (var r12) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec r13" 49ffcd 0x0 (seq (set _op (var r13)) (set _dec (- (var _op) (bv 64 0x1))) (set r13 (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec r13d" 41ffcd 0x0 (seq (set _op (cast 32 false (var r13))) (set _dec (- (var _op) (bv 32 0x1))) (set r13 (| (& (var r13) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec r14" 49ffce 0x0 (seq (set _op (var r14)) (set _dec (- (var _op) (bv 64 0x1))) (set r14 (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec r14d" 41ffce 0x0 (seq (set _op (cast 32 false (var r14))) (set _dec (- (var _op) (bv 32 0x1))) (set r14 (| (& (var r14) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec r15" 49ffcf 0x0 (seq (set _op (var r15)) (set _dec (- (var _op) (bv 64 0x1))) (set r15 (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec r15d" 41ffcf 0x0 (seq (set _op (cast 32 false (var r15))) (set _dec (- (var _op) (bv 32 0x1))) (set r15 (| (& (var r15) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec r8" 49ffc8 0x0 (seq (set _op (var r8)) (set _dec (- (var _op) (bv 64 0x1))) (set r8 (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec r8d" 41ffc8 0x0 (seq (set _op (cast 32 false (var r8))) (set _dec (- (var _op) (bv 32 0x1))) (set r8 (| (& (var r8) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec r9" 49ffc9 0x0 (seq (set _op (var r9)) (set _dec (- (var _op) (bv 64 0x1))) (set r9 (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec r9d" 41ffc9 0x0 (seq (set _op (cast 32 false (var r9))) (set _dec (- (var _op) (bv 32 0x1))) (set r9 (| (& (var r9) (~ (bv 64 0xffffffff))) (cast 64 false (var _dec)))) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 32 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec rax" 48ffc8 0x0 (seq (set _op (var rax)) (set _dec (- (var _op) (bv 64 0x1))) (set rax (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec rbp" 48ffcd 0x0 (seq (set _op (var rbp)) (set _dec (- (var _op) (bv 64 0x1))) (set rbp (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec rbx" 48ffcb 0x0 (seq (set _op (var rbx)) (set _dec (- (var _op) (bv 64 0x1))) (set rbx (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec rcx" 48ffc9 0x0 (seq (set _op (var rcx)) (set _dec (- (var _op) (bv 64 0x1))) (set rcx (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec rdi" 48ffcf 0x0 (seq (set _op (var rdi)) (set _dec (- (var _op) (bv 64 0x1))) (set rdi (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec rdx" 48ffca 0x0 (seq (set _op (var rdx)) (set _dec (- (var _op) (bv 64 0x1))) (set rdx (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec rsi" 48ffce 0x0 (seq (set _op (var rsi)) (set _dec (- (var _op) (bv 64 0x1))) (set rsi (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 64 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) +a "dec WORD PTR [rdi+0x88]" 66ff8f88000000 0x0 (seq (set _op (loadw 0 16 (+ (var rdi) (bv 64 0x88)))) (set _dec (- (var _op) (bv 16 0x1))) (storew 0 (+ (var rdi) (bv 64 0x88)) (var _dec)) (set _result (var _dec)) (set _popcnt (bv 8 0x0)) (set _val (cast 8 false (var _result))) (repeat (is_zero (var _val)) (seq (set _popcnt (+ (var _popcnt) (ite (lsb (var _val)) (bv 8 0x1) (bv 8 0x0)))) (set _val (>> (var _val) (bv 8 0x1) false)))) (set pf (is_zero (mod (var _popcnt) (bv 8 0x2)))) (set zf (is_zero (var _result))) (set sf (msb (var _result))) (set _result (var _dec)) (set _x (var _op)) (set _y (bv 16 0x1)) (set of (|| (&& (&& (! (msb (var _result))) (msb (var _x))) (! (msb (var _y)))) (&& (&& (msb (var _result)) (! (msb (var _x)))) (msb (var _y))))) (set af (|| (|| (&& (! (msb (cast 4 false (var _x)))) (msb (cast 4 false (var _y)))) (&& (msb (cast 4 false (var _y))) (msb (cast 4 false (var _result))))) (&& (msb (cast 4 false (var _result))) (! (msb (cast 4 false (var _x)))))))) a "bswap rax" 480fc8 a "bswap r15" 490fcf a "bswap eax" 0fc8 a "bswap r15d" 410fcf ad "endbr64" f30f1efa -ad "xchg eax, r8d" 4190 -a "xchg r8d, eax" 4190 -ad "xchg rax, rdx" 4892 -a "xchg rdx, rax" 4892 -ad "xchg rax, r8" 4990 -a "xchg r8, rax" 4990 -ad "xchg rdx, rbx" 4887da -ad "xchg rbx, rdx" 4887d3 -ad "xchg r8, r15" 4d87f8 -ad "xchg r15, r8" 4d87c7 -ad "xchg r8d, r15d" 4587f8 -ad "xchg r15d, r8d" 4587c7 -ad "xchg rdx, r8" 4c87c2 -ad "xchg r15, rdx" 4987d7 -d "call qword [rip + 0x3a8f3e]" 48ff153e8f3a00 -d "call qword [rip + 0x1d638f]" 48ff158f631d00 +d "enter 8, 0" c8080000 0x0 (seq (set _alloc_sz (cast 16 false (bv 64 0x8))) (set _nest_lvl (mod (cast 8 false (bv 64 0x0)) (bv 8 0x20))) (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (var rbp))) (set _frame_tmp (var rsp)) (branch (is_zero (var _nest_lvl)) nop (seq (branch (! (ule (var _nest_lvl) (bv 8 0x1))) (seq (set _itr (bv 8 0x1)) (repeat (&& (ule (var _itr) (var _nest_lvl)) (! (== (var _itr) (var _nest_lvl)))) (seq (set rbp (- (var rbp) (bv 64 0x8))) (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (loadw 0 64 (var rbp)))) (set _itr (+ (var _itr) (bv 8 0x1)))))) nop) (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (var _frame_tmp))))) (set rsp (- (var rsp) (cast 64 false (var _alloc_sz)))) (set rbp (var _frame_tmp))) +d "enter 8, 0" 66c8080000 0x0 (seq (set _alloc_sz (cast 16 false (bv 32 0x8))) (set _nest_lvl (mod (cast 8 false (bv 32 0x0)) (bv 8 0x20))) (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (cast 32 false (var rbp)))) (set _frame_tmp (var rsp)) (branch (is_zero (var _nest_lvl)) nop (seq (branch (! (ule (var _nest_lvl) (bv 8 0x1))) (seq (set _itr (bv 8 0x1)) (repeat (&& (ule (var _itr) (var _nest_lvl)) (! (== (var _itr) (var _nest_lvl)))) (seq (set rbp (- (var rbp) (bv 64 0x4))) (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (loadw 0 32 (var rbp)))) (set _itr (+ (var _itr) (bv 8 0x1)))))) nop) (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 64 false (var _frame_tmp))))) (set rsp (- (var rsp) (cast 64 false (var _alloc_sz)))) (set rbp (| (& (var rbp) (~ (bv 64 0xffffffff))) (cast 64 false (var _frame_tmp))))) +ad "xchg eax, r8d" 4190 0x0 (seq (set _temp (cast 32 false (var rax))) (set rax (| (& (var rax) (~ (bv 64 0xffffffff))) (cast 64 false (cast 32 false (var r8))))) (set r8 (| (& (var r8) (~ (bv 64 0xffffffff))) (cast 64 false (var _temp))))) +a "xchg r8d, eax" 4190 0x0 (seq (set _temp (cast 32 false (var rax))) (set rax (| (& (var rax) (~ (bv 64 0xffffffff))) (cast 64 false (cast 32 false (var r8))))) (set r8 (| (& (var r8) (~ (bv 64 0xffffffff))) (cast 64 false (var _temp))))) +ad "xchg rax, rdx" 4892 0x0 (seq (set _temp (var rax)) (set rax (var rdx)) (set rdx (var _temp))) +a "xchg rdx, rax" 4892 0x0 (seq (set _temp (var rax)) (set rax (var rdx)) (set rdx (var _temp))) +ad "xchg rax, r8" 4990 0x0 (seq (set _temp (var rax)) (set rax (var r8)) (set r8 (var _temp))) +a "xchg r8, rax" 4990 0x0 (seq (set _temp (var rax)) (set rax (var r8)) (set r8 (var _temp))) +ad "xchg rdx, rbx" 4887da 0x0 (seq (set _temp (var rdx)) (set rdx (var rbx)) (set rbx (var _temp))) +ad "xchg rbx, rdx" 4887d3 0x0 (seq (set _temp (var rbx)) (set rbx (var rdx)) (set rdx (var _temp))) +ad "xchg r8, r15" 4d87f8 0x0 (seq (set _temp (var r8)) (set r8 (var r15)) (set r15 (var _temp))) +ad "xchg r15, r8" 4d87c7 0x0 (seq (set _temp (var r15)) (set r15 (var r8)) (set r8 (var _temp))) +ad "xchg r8d, r15d" 4587f8 0x0 (seq (set _temp (cast 32 false (var r8))) (set r8 (| (& (var r8) (~ (bv 64 0xffffffff))) (cast 64 false (cast 32 false (var r15))))) (set r15 (| (& (var r15) (~ (bv 64 0xffffffff))) (cast 64 false (var _temp))))) +ad "xchg r15d, r8d" 4587c7 0x0 (seq (set _temp (cast 32 false (var r15))) (set r15 (| (& (var r15) (~ (bv 64 0xffffffff))) (cast 64 false (cast 32 false (var r8))))) (set r8 (| (& (var r8) (~ (bv 64 0xffffffff))) (cast 64 false (var _temp))))) +ad "xchg rdx, r8" 4c87c2 0x0 (seq (set _temp (var rdx)) (set rdx (var r8)) (set r8 (var _temp))) +ad "xchg r15, rdx" 4987d7 0x0 (seq (set _temp (var r15)) (set r15 (var rdx)) (set rdx (var _temp))) +d "call qword [rip + 0x3a8f3e]" 48ff153e8f3a00 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0)))) +d "call qword [rip + 0x1d638f]" 48ff158f631d00 0x0 (seq (set rsp (- (var rsp) (bv 64 0x8))) (storew 0 (+ (var rsp) (bv 64 0x0)) (cast 16 false (bv 64 0x0)))) a "fmul st2, st0" dcca a "fdiv st0, st1" d8f1 a "fdiv st(0), st(1)" d8f1 diff --git a/test/db/cmd/cmd_a8 b/test/db/cmd/cmd_a8 index ab909a68f3..fde1b35af5 100644 --- a/test/db/cmd/cmd_a8 +++ b/test/db/cmd/cmd_a8 @@ -18,6 +18,6 @@ e asm.bits=64 a8j c745f400000000 EOF EXPECT=<