SMPInstr.cpp

		TempRT->SetLeftOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetRightOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// EDX comes from [ESP+20]
		RegOp.reg = R_dx;
		StackOp.addr = 20;  // [ESP+20]
		TempRT = new SMPRegTransfer;
		TempRT->SetLeftOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetRightOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// ECX comes from [ESP+24]
		RegOp.reg = R_cx;
		StackOp.addr = 24;  // [ESP+24]
		TempRT = new SMPRegTransfer;
		TempRT->SetLeftOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetRightOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// EAX comes from [ESP+28]
		RegOp.reg = R_ax;
		StackOp.addr = 28;  // [ESP+28]
		TempRT = new SMPRegTransfer;
		TempRT->SetLeftOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetRightOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// Now create the stack pointer increment effect.
		this->AddToStackPointer(32);
		return true;
	} // end for "pop all" instructions

	// If we reach this point, we have a simple POP instruction.
	for (OpNum = 0; !DestFound && (OpNum < UA_MAXOP); ++OpNum) {
		op_t TempOp = this->SMPcmd.Operands[OpNum];
		if (this->features & DefMacros[OpNum]) { // DEF
			if (MDKnownOperandType(TempOp)) {
				DestFound = true;
				TempRT = new SMPRegTransfer;
				TempRT->SetLeftOperand(TempOp);
				TempRT->SetOperator(SMP_ASSIGN);
				StackOp.dtyp = TempOp.dtyp;  // size of transfer
				TempRT->SetRightOperand(StackOp);
				this->RTL.push_back(TempRT);
				// Now create the stack pointer increment effect.
				OpSize = GetOpDataSize(TempOp);
				this->AddToStackPointer((uval_t) OpSize);
			}
		}
	} // end for (OpNum = 0; ...)

#if SMP_DEBUG_BUILD_RTL
	if (!DestFound) {
		msg("ERROR: Could not find pop operand at %x for %s\n", this->GetAddr(), this->GetDisasm());
	}
#endif
	return DestFound;
} // end of SMPInstr::BuildPopRTL()

#define SMP_FIRST_PUSH_FLAGS  NN_pushfw
#define SMP_LAST_PUSH_FLAGS  NN_pushfq
#define SMP_FIRST_PUSH_ALL  NN_pushaw
#define SMP_LAST_PUSH_ALL  NN_pushaq
// Build the RTL for a push instruction
bool SMPInstr::BuildPushRTL(void) {
	size_t OpNum, OpSize;
	bool SourceFound = false;
	SMPRegTransfer *TempRT = NULL;
	op_t StackOp, FlagsOp;
	StackOp.type = o_displ;
	StackOp.reg = R_sp;
	StackOp.addr = (ea_t) -4;  // [ESP-4]
	StackOp.hasSIB = 0;
	StackOp.dtyp = dt_dword;
	FlagsOp.type = o_reg;
	FlagsOp.reg = X86_FLAGS_REG;
	FlagsOp.dtyp = dt_dword;

	// Handle special cases first.
	if ((SMP_FIRST_PUSH_FLAGS <= this->SMPcmd.itype) && (SMP_LAST_PUSH_FLAGS >= this->SMPcmd.itype)) {
		TempRT = new SMPRegTransfer;
		TempRT->SetRightOperand(FlagsOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetLeftOperand(StackOp);
		this->RTL.push_back(TempRT);
		// Now create the stack pointer increment effect.
		this->SubFromStackPointer(4);
		return true;
	}

	if ((SMP_FIRST_PUSH_ALL <= this->SMPcmd.itype) && (SMP_LAST_PUSH_ALL >= this->SMPcmd.itype)) {
		op_t RegOp;
		RegOp.type = o_reg;

		// EDI goes to [ESP-32]
		RegOp.reg = R_di;
		StackOp.addr = (ea_t) -32;  // [ESP-32]
		TempRT = new SMPRegTransfer;
		TempRT->SetRightOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetLeftOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// ESI goes to [ESP-28]
		RegOp.reg = R_si;
		StackOp.addr = (ea_t) -28;  // [ESP-28]
		TempRT = new SMPRegTransfer;
		TempRT->SetRightOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetLeftOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// EBP goes to [ESP-24]
		RegOp.reg = R_bp;
		StackOp.addr = (ea_t) -24;  // [ESP-24]
		TempRT = new SMPRegTransfer;
		TempRT->SetRightOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetLeftOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// ESP goes to [ESP-20]
		RegOp.reg = R_sp;
		StackOp.addr = (ea_t) -20;  // [ESP-20]
		TempRT = new SMPRegTransfer;
		TempRT->SetRightOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetLeftOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// EBX goes to [ESP-16]
		RegOp.reg = R_bx;
		StackOp.addr = (ea_t) -16;  // [ESP-16]
		TempRT = new SMPRegTransfer;
		TempRT->SetRightOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetLeftOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// EDX goes to [ESP-12]
		RegOp.reg = R_dx;
		StackOp.addr = (ea_t) -12;  // [ESP-12]
		TempRT = new SMPRegTransfer;
		TempRT->SetRightOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetLeftOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// ECX goes to [ESP-8]
		RegOp.reg = R_cx;
		StackOp.addr = (ea_t) -8;  // [ESP-8]
		TempRT = new SMPRegTransfer;
		TempRT->SetRightOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetLeftOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// EAX goes to [ESP-4]
		RegOp.reg = R_ax;
		StackOp.addr = (ea_t) -4;  // [ESP-4]
		TempRT = new SMPRegTransfer;
		TempRT->SetRightOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetLeftOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// Now create the stack pointer increment effect.
		this->SubFromStackPointer(32);
		return true;
	} // end for "pop all" instructions

	// If we reach this point, we have a simple PUSH instruction.
	for (OpNum = 0; !SourceFound && (OpNum < UA_MAXOP); ++OpNum) {
		op_t TempOp = this->SMPcmd.Operands[OpNum];
		if (this->features & UseMacros[OpNum]) { // USE
			if (MDKnownOperandType(TempOp)) {
				SourceFound = true;
				OpSize = GetOpDataSize(TempOp);
				TempRT = new SMPRegTransfer;
				TempRT->SetRightOperand(TempOp);
				TempRT->SetOperator(SMP_ASSIGN);
				StackOp.dtyp = TempOp.dtyp;  // size of transfer
				StackOp.addr = (ea_t) (-((signed int) OpSize));
				TempRT->SetLeftOperand(StackOp);
				this->RTL.push_back(TempRT);
				TempRT = NULL;
				// Now create the stack pointer increment effect.
				this->SubFromStackPointer((uval_t) OpSize);
			}
		}
	} // end for (OpNum = 0; ...)

#if SMP_DEBUG_BUILD_RTL
	if (!SourceFound) {
		msg("ERROR: Could not find push operand at %x for %s\n", this->GetAddr(), this->GetDisasm());
	}
#endif
	return SourceFound;
} // end of SMPInstr::BuildPushRTL()

// Build RTL trees from the SMPcmd info.
bool SMPInstr::BuildRTL(void) {
	op_t FlagsOp;
	FlagsOp.type = o_reg;
	FlagsOp.reg = X86_FLAGS_REG;
	SMPRegTransfer *NopRT = NULL;  // no-op register transfer

	// We don't want to explicitly represent the various no-ops except as NULL operations.
	//  E.g. mov esi,esi should not generate DEF and USE of esi, because esi does not change.
	if (this->MDIsNop()) {
		NopRT = new SMPRegTransfer;
		NopRT->SetOperator(SMP_NULL_OPERATOR);
		this->RTL.push_back(NopRT);
		NopRT = NULL;
		return true;
	}

	switch (this->SMPcmd.itype) {
		case NN_aaa:                 // ASCII Adjust after Addition
		case NN_aad:                 // ASCII Adjust AX before Division
		case NN_aam:                 // ASCII Adjust AX after Multiply
		case NN_aas:                 // ASCII Adjust AL after Subtraction
			return this->BuildUnaryRTL(SMP_UNARY_NUMERIC_OPERATION);

		case NN_adc:                 // Add with Carry
			return this->BuildBinaryPlusFlagsRTL(SMP_ADD_CARRY);

		case NN_add:                 // Add
			return this->BuildBinaryRTL(SMP_ADD);

		case NN_and:                 // Logical AND
			return this->BuildBinaryRTL(SMP_BITWISE_AND);

		case NN_arpl:                // Adjust RPL Field of Selector
		case NN_bound:               // Check Array Index Against Bounds
			return false;
			break;

		case NN_bsf:                 // Bit Scan Forward
		case NN_bsr:                 // Bit Scan Reverse
			return this->BuildUnary2OpndRTL(SMP_UNARY_NUMERIC_OPERATION);

		case NN_bt:                  // Bit Test
			return this->BuildFlagsDestBinaryRTL(SMP_BINARY_NUMERIC_OPERATION);

		case NN_btc:                 // Bit Test and Complement
		case NN_btr:                 // Bit Test and Reset
		case NN_bts:                 // Bit Test and Set
			// Has effects on both the carry flag and the first operand
			this->RTL.ExtraKills.push_back(FlagsOp);
			return this->BuildBinaryRTL(SMP_BINARY_NUMERIC_OPERATION);

		case NN_call:                // Call Procedure
		case NN_callfi:              // Indirect Call Far Procedure
		case NN_callni:              // Indirect Call Near Procedure
			return this->BuildCallRTL();

		case NN_cbw:                 // AL -> AX (with sign)
		case NN_cwde:                // AX -> EAX (with sign)
		case NN_cdqe:                // EAX -> RAX (with sign)
			return this->BuildUnaryRTL(SMP_SIGN_EXTEND);

		case NN_clc:                 // Clear Carry Flag
		case NN_cld:                 // Clear Direction Flag
			return this->BuildUnaryRTL(SMP_UNARY_NUMERIC_OPERATION);

		case NN_cli:                 // Clear Interrupt Flag
		case NN_clts:                // Clear Task-Switched Flag in CR0
			// We don't track the interrupt flag or the special registers,
			//  so we can just consider these to be no-ops.
			NopRT = new SMPRegTransfer;
			NopRT->SetOperator(SMP_NULL_OPERATOR);
			this->RTL.push_back(NopRT);
			NopRT = NULL;
			return true;

		case NN_cmc:                 // Complement Carry Flag
			return this->BuildUnaryRTL(SMP_UNARY_NUMERIC_OPERATION);

		case NN_cmp:                 // Compare Two Operands
			return this->BuildFlagsDestBinaryRTL(SMP_S_COMPARE);

		case NN_cmps:                // Compare Strings
			return this->BuildFlagsDestBinaryRTL(SMP_U_COMPARE);

		case NN_cwd:                 // AX -> DX:AX (with sign)
		case NN_cdq:                 // EAX -> EDX:EAX (with sign)
		case NN_cqo:                 // RAX -> RDX:RAX (with sign)
			return this->BuildUnary2OpndRTL(SMP_SIGN_EXTEND);

		case NN_daa:                 // Decimal Adjust AL after Addition
		case NN_das:                 // Decimal Adjust AL after Subtraction
			return this->BuildUnaryRTL(SMP_UNARY_NUMERIC_OPERATION);

		case NN_dec:                 // Decrement by 1
			return this->BuildBinaryRTL(SMP_SUBTRACT);

		case NN_div:                 // Unsigned Divide
			return this->BuildMultiplyDivideRTL(SMP_U_DIVIDE);

		case NN_enterw:              // Make Stack Frame for Procedure Parameters
		case NN_enter:               // Make Stack Frame for Procedure Parameters
		case NN_enterd:              // Make Stack Frame for Procedure Parameters
		case NN_enterq:              // Make Stack Frame for Procedure Parameters
			return this->BuildEnterRTL();

		case NN_hlt:                 // Halt
			// Treat as a no-op
			NopRT = new SMPRegTransfer;
			NopRT->SetOperator(SMP_NULL_OPERATOR);
			this->RTL.push_back(NopRT);
			NopRT = NULL;
			return true;

		case NN_idiv:                // Signed Divide
			return this->BuildMultiplyDivideRTL(SMP_S_DIVIDE);

		case NN_imul:                // Signed Multiply
			return this->BuildMultiplyDivideRTL(SMP_S_MULTIPLY);

		case NN_in:                  // Input from Port
			return this->BuildUnary2OpndRTL(SMP_INPUT);

		case NN_inc:                 // Increment by 1
			return this->BuildBinaryRTL(SMP_ADD);

		case NN_ins:                 // Input Byte(s) from Port to String
			return false;
			break;

		case NN_int:                 // Call to Interrupt Procedure
		case NN_into:                // Call to Interrupt Procedure if Overflow Flag = 1
		case NN_int3:                // Trap to Debugger
			return this->BuildCallRTL();

		case NN_iretw:               // Interrupt Return
		case NN_iret:                // Interrupt Return
		case NN_iretd:               // Interrupt Return (use32)
		case NN_iretq:               // Interrupt Return (use64)
			return this->BuildReturnRTL();

		case NN_ja:                  // Jump if Above (CF=0 & ZF=0)
		case NN_jae:                 // Jump if Above or Equal (CF=0)
		case NN_jb:                  // Jump if Below (CF=1)
		case NN_jbe:                 // Jump if Below or Equal (CF=1 | ZF=1)
		case NN_jc:                  // Jump if Carry (CF=1)
			return this->BuildJumpRTL(SMP_BINARY_NUMERIC_OPERATION);

		case NN_jcxz:                // Jump if CX is 0
		case NN_jecxz:               // Jump if ECX is 0
		case NN_jrcxz:               // Jump if RCX is 0
			return this->BuildJumpRTL(SMP_EQUAL); // special case in BuildJumpRTL()

		case NN_je:                  // Jump if Equal (ZF=1)
			return this->BuildJumpRTL(SMP_EQUAL);

		case NN_jg:                  // Jump if Greater (ZF=0 & SF=OF)
			return this->BuildJumpRTL(SMP_GREATER_THAN);

		case NN_jge:                 // Jump if Greater or Equal (SF=OF)
			return this->BuildJumpRTL(SMP_GREATER_EQUAL);

		case NN_jl:                  // Jump if Less (SF!=OF)
			return this->BuildJumpRTL(SMP_LESS_THAN);

		case NN_jle:                 // Jump if Less or Equal (ZF=1 | SF!=OF)
			return this->BuildJumpRTL(SMP_LESS_EQUAL);

		case NN_jna:                 // Jump if Not Above (CF=1 | ZF=1)
		case NN_jnae:                // Jump if Not Above or Equal (CF=1)
		case NN_jnb:                 // Jump if Not Below (CF=0)
		case NN_jnbe:                // Jump if Not Below or Equal (CF=0 & ZF=0) a.k.a. ja
		case NN_jnc:                 // Jump if Not Carry (CF=0)
			return this->BuildJumpRTL(SMP_BINARY_NUMERIC_OPERATION);

		case NN_jne:                 // Jump if Not Equal (ZF=0)
			return this->BuildJumpRTL(SMP_NOT_EQUAL);

		case NN_jng:                 // Jump if Not Greater (ZF=1 | SF!=OF) a.k.a. jle
			return this->BuildJumpRTL(SMP_LESS_EQUAL);

		case NN_jnge:                // Jump if Not Greater or Equal (SF != OF) **
			return this->BuildJumpRTL(SMP_LESS_THAN);

		case NN_jnl:                 // Jump if Not Less (SF=OF) a.k.a. jge
			return this->BuildJumpRTL(SMP_GREATER_EQUAL);

		case NN_jnle:                // Jump if Not Less or Equal (ZF=0 & SF=OF) a.k.a. jg
			return this->BuildJumpRTL(SMP_GREATER_THAN);

		case NN_jno:                 // Jump if Not Overflow (OF=0)
		case NN_jnp:                 // Jump if Not Parity (PF=0)
		case NN_jns:                 // Jump if Not Sign (SF=0)
			return this->BuildJumpRTL(SMP_BINARY_NUMERIC_OPERATION);

		case NN_jnz:                 // Jump if Not Zero (ZF=0)  a.k.a. jne
			return this->BuildJumpRTL(SMP_NOT_EQUAL);

		case NN_jo:                  // Jump if Overflow (OF=1)
		case NN_jp:                  // Jump if Parity (PF=1)
		case NN_jpe:                 // Jump if Parity Even (PF=1)
		case NN_jpo:                 // Jump if Parity Odd  (PF=0)
		case NN_js:                  // Jump if Sign (SF=1)
			return this->BuildJumpRTL(SMP_BINARY_NUMERIC_OPERATION);

		case NN_jz:                  // Jump if Zero (ZF=1)
			return this->BuildJumpRTL(SMP_EQUAL);

		case NN_jmp:                 // Jump
		case NN_jmpfi:               // Indirect Far Jump
		case NN_jmpni:               // Indirect Near Jump
		case NN_jmpshort:            // Jump Short (not used)
			return this->BuildJumpRTL(SMP_NULL_OPERATOR);

		case NN_lahf:                // Load Flags into AH Register
			return this->BuildMoveRTL(SMP_NULL_OPERATOR);

		case NN_lar:                 // Load Access Right Byte
			return false;
			break;

		case NN_lea:                 // Load Effective Address
			return this->BuildUnary2OpndRTL(SMP_ADDRESS_OF);

		case NN_leavew:              // High Level Procedure Exit
		case NN_leave:               // High Level Procedure Exit
		case NN_leaved:              // High Level Procedure Exit
		case NN_leaveq:              // High Level Procedure Exit
			return this->BuildLeaveRTL();

		case NN_lgdt:                // Load Global Descriptor Table Register
		case NN_lidt:                // Load Interrupt Descriptor Table Register
		case NN_lgs:                 // Load Full Pointer to GS:xx
		case NN_lss:                 // Load Full Pointer to SS:xx
		case NN_lds:                 // Load Full Pointer to DS:xx
		case NN_les:                 // Load Full Pointer to ES:xx
		case NN_lfs:                 // Load Full Pointer to FS:xx
		case NN_lldt:                // Load Local Descriptor Table Register
		case NN_lmsw:                // Load Machine Status Word
		case NN_lock:                // Assert LOCK# Signal Prefix
		case NN_lods:                // Load String
			return false;
			break;

		case NN_loopw:               // Loop while ECX != 0
		case NN_loop:                // Loop while CX != 0
		case NN_loopd:               // Loop while ECX != 0
		case NN_loopq:               // Loop while RCX != 0
		case NN_loopwe:              // Loop while CX != 0 and ZF=1
		case NN_loope:               // Loop while rCX != 0 and ZF=1
		case NN_loopde:              // Loop while ECX != 0 and ZF=1
		case NN_loopqe:              // Loop while RCX != 0 and ZF=1
		case NN_loopwne:             // Loop while CX != 0 and ZF=0
		case NN_loopne:              // Loop while rCX != 0 and ZF=0
		case NN_loopdne:             // Loop while ECX != 0 and ZF=0
		case NN_loopqne:             // Loop while RCX != 0 and ZF=0
			return false;
			break;

		case NN_lsl:                 // Load Segment Limit
		case NN_ltr:                 // Load Task Register
			return false;
			break;

		case NN_mov:                 // Move Data
		case NN_movsp:               // Move to/from Special Registers
		case NN_movs:                // Move Byte(s) from String to String
			return this->BuildMoveRTL(SMP_NULL_OPERATOR);

		case NN_movsx:               // Move with Sign-Extend
			return this->BuildUnary2OpndRTL(SMP_SIGN_EXTEND);

		case NN_movzx:               // Move with Zero-Extend
			return this->BuildUnary2OpndRTL(SMP_ZERO_EXTEND);

		case NN_mul:                 // Unsigned Multiplication of AL or AX
			return this->BuildMultiplyDivideRTL(SMP_U_MULTIPLY);

		case NN_neg:                 // Two's Complement Negation
			return this->BuildUnaryRTL(SMP_NEGATE);

		case NN_nop:                 // No Operation
			NopRT = new SMPRegTransfer;
			NopRT->SetOperator(SMP_NULL_OPERATOR);
			this->RTL.push_back(NopRT);
			NopRT = NULL;
			return true;

		case NN_not:                 // One's Complement Negation
			return this->BuildUnaryRTL(SMP_BITWISE_NOT);

		case NN_or:                  // Logical Inclusive OR
			return this->BuildBinaryRTL(SMP_BITWISE_OR);

		case NN_out:                 // Output to Port
			return this->BuildBinaryRTL(SMP_OUTPUT);

		case NN_outs:                // Output Byte(s) to Port
			return false;
			break;

		case NN_pop:                 // Pop a word from the Stack
		case NN_popaw:               // Pop all General Registers
		case NN_popa:                // Pop all General Registers
		case NN_popad:               // Pop all General Registers (use32)
		case NN_popaq:               // Pop all General Registers (use64)
		case NN_popfw:               // Pop Stack into Flags Register
		case NN_popf:                // Pop Stack into Flags Register
		case NN_popfd:               // Pop Stack into Eflags Register
		case NN_popfq:               // Pop Stack into Rflags Register
			return this->BuildPopRTL();

		case NN_push:                // Push Operand onto the Stack
		case NN_pushaw:              // Push all General Registers
		case NN_pusha:               // Push all General Registers
		case NN_pushad:              // Push all General Registers (use32)
		case NN_pushaq:              // Push all General Registers (use64)
		case NN_pushfw:              // Push Flags Register onto the Stack
		case NN_pushf:               // Push Flags Register onto the Stack
		case NN_pushfd:              // Push Flags Register onto the Stack (use32)
		case NN_pushfq:              // Push Flags Register onto the Stack (use64)
			return this->BuildPushRTL();

		case NN_rcl:                 // Rotate Through Carry Left
			return this->BuildBinaryPlusFlagsRTL(SMP_ROTATE_LEFT_CARRY);

		case NN_rcr:                 // Rotate Through Carry Right
			return this->BuildBinaryPlusFlagsRTL(SMP_ROTATE_RIGHT_CARRY);

		case NN_rol:                 // Rotate Left
			return this->BuildBinaryRTL(SMP_ROTATE_LEFT);

		case NN_ror:                 // Rotate Right
			return this->BuildBinaryRTL(SMP_ROTATE_RIGHT);

		case NN_rep:                 // Repeat String Operation
		case NN_repe:                // Repeat String Operation while ZF=1
		case NN_repne:               // Repeat String Operation while ZF=0
			return false;
			break;

		case NN_retn:                // Return Near from Procedure
		case NN_retf:                // Return Far from Procedure
			return this->BuildReturnRTL();

		case NN_sahf:                // Store AH into Flags Register
			return this->BuildMoveRTL(SMP_NULL_OPERATOR);

		case NN_sal:                 // Shift Arithmetic Left
			return this->BuildBinaryRTL(SMP_S_LEFT_SHIFT);

		case NN_sar:                 // Shift Arithmetic Right
			return this->BuildBinaryRTL(SMP_S_RIGHT_SHIFT);

		case NN_shl:                 // Shift Logical Left
			return this->BuildBinaryRTL(SMP_U_LEFT_SHIFT);

		case NN_shr:                 // Shift Logical Right
			return this->BuildBinaryRTL(SMP_U_RIGHT_SHIFT);

		case NN_sbb:                 // Integer Subtraction with Borrow
			return this->BuildBinaryPlusFlagsRTL(SMP_SUBTRACT_BORROW);

		case NN_scas:                // Compare String
			return this->BuildBinaryPlusFlagsRTL(SMP_U_COMPARE);

		case NN_seta:                // Set Byte if Above (CF=0 & ZF=0)
		case NN_setae:               // Set Byte if Above or Equal (CF=0)
		case NN_setb:                // Set Byte if Below (CF=1)
		case NN_setbe:               // Set Byte if Below or Equal (CF=1 | ZF=1)
		case NN_setc:                // Set Byte if Carry (CF=1)
		case NN_sete:                // Set Byte if Equal (ZF=1)
		case NN_setg:                // Set Byte if Greater (ZF=0 & SF=OF)
		case NN_setge:               // Set Byte if Greater or Equal (SF=OF)
		case NN_setl:                // Set Byte if Less (SF!=OF)
		case NN_setle:               // Set Byte if Less or Equal (ZF=1 | SF!=OF)
		case NN_setna:               // Set Byte if Not Above (CF=1 | ZF=1)
		case NN_setnae:              // Set Byte if Not Above or Equal (CF=1)
		case NN_setnb:               // Set Byte if Not Below (CF=0)
		case NN_setnbe:              // Set Byte if Not Below or Equal (CF=0 & ZF=0)
		case NN_setnc:               // Set Byte if Not Carry (CF=0)
		case NN_setne:               // Set Byte if Not Equal (ZF=0)
		case NN_setng:               // Set Byte if Not Greater (ZF=1 | SF!=OF)
		case NN_setnge:              // Set Byte if Not Greater or Equal (ZF=1)
		case NN_setnl:               // Set Byte if Not Less (SF=OF)
		case NN_setnle:              // Set Byte if Not Less or Equal (ZF=0 & SF=OF)
		case NN_setno:               // Set Byte if Not Overflow (OF=0)
		case NN_setnp:               // Set Byte if Not Parity (PF=0)
		case NN_setns:               // Set Byte if Not Sign (SF=0)
		case NN_setnz:               // Set Byte if Not Zero (ZF=0)
		case NN_seto:                // Set Byte if Overflow (OF=1)
		case NN_setp:                // Set Byte if Parity (PF=1)
		case NN_setpe:               // Set Byte if Parity Even (PF=1)
		case NN_setpo:               // Set Byte if Parity Odd  (PF=0)
		case NN_sets:                // Set Byte if Sign (SF=1)
		case NN_setz:                // Set Byte if Zero (ZF=1)
			// Destination always get set to NUMERIC 0 or 1, depending on
			//  the condition and the relevant flags bits. Best way to model
			//  this in an RTL is to perform an unspecified unary NUMERIC
			//  operation on the flags register and assign the result to the
			//  destination operand, making it always NUMERIC.
			return this->BuildUnary2OpndRTL(SMP_UNARY_NUMERIC_OPERATION);

		case NN_sgdt:                // Store Global Descriptor Table Register
		case NN_sidt:                // Store Interrupt Descriptor Table Register
			return false;
			break;

		case NN_shld:                // Double Precision Shift Left
			return this->BuildDoubleShiftRTL(SMP_U_LEFT_SHIFT);

		case NN_shrd:                // Double Precision Shift Right
			return this->BuildDoubleShiftRTL(SMP_U_RIGHT_SHIFT);

		case NN_sldt:                // Store Local Descriptor Table Register
		case NN_smsw:                // Store Machine Status Word
			return false;
			break;

		case NN_stc:                 // Set Carry Flag
		case NN_std:                 // Set Direction Flag
			return this->BuildUnaryRTL(SMP_UNARY_NUMERIC_OPERATION);

		case NN_sti:                 // Set Interrupt Flag
			NopRT = new SMPRegTransfer;
			NopRT->SetOperator(SMP_NULL_OPERATOR);
			this->RTL.push_back(NopRT);
			NopRT = NULL;
			return true;

		case NN_stos:                // Store String
			return this->BuildMoveRTL(SMP_NULL_OPERATOR);

		case NN_str:                 // Store Task Register
			return false;
			break;

		case NN_sub:                 // Integer Subtraction
			return this->BuildBinaryRTL(SMP_SUBTRACT);

		case NN_test:                // Logical Compare
			return this->BuildFlagsDestBinaryRTL(SMP_U_COMPARE);

		case NN_verr:                // Verify a Segment for Reading
		case NN_verw:                // Verify a Segment for Writing
		case NN_wait:                // Wait until BUSY# Pin is Inactive (HIGH)
			NopRT = new SMPRegTransfer;
			NopRT->SetOperator(SMP_NULL_OPERATOR);
			this->RTL.push_back(NopRT);
			NopRT = NULL;
			if (NN_wait != this->SMPcmd.itype)
				this->RTL.ExtraKills.push_back(FlagsOp);
			return true;

		case NN_xchg:                // Exchange Register/Memory with Register
			return this->BuildExchangeRTL();

		case NN_xlat:                // Table Lookup Translation
			return false;
			break;

		case NN_xor:                 // Logical Exclusive OR
			return this->BuildBinaryRTL(SMP_BITWISE_XOR);


		//
		//      486 instructions
		//

		case NN_cmpxchg:             // Compare and Exchange
			return this->BuildCompareExchangeRTL();

		case NN_bswap:               // Swap bits in EAX
			return false;
			break;

		case NN_xadd:                // t<-dest; dest<-src+dest; src<-t
			return this->BuildExchangeAddRTL();

		case NN_invd:                // Invalidate Data Cache
		case NN_wbinvd:              // Invalidate Data Cache (write changes)
		case NN_invlpg:              // Invalidate TLB entry
			NopRT = new SMPRegTransfer;
			NopRT->SetOperator(SMP_NULL_OPERATOR);
			this->RTL.push_back(NopRT);
			NopRT = NULL;
			return true;

		//
		//      Pentium instructions
		//

		case NN_rdmsr:               // Read Machine Status Register
			return this->BuildOptType8RTL();

		case NN_wrmsr:               // Write Machine Status Register
			return false;
			break;

		case NN_cpuid:               // Get CPU ID
			return this->BuildOptType8RTL();

		case NN_cmpxchg8b:           // Compare and Exchange Eight Bytes
			return false;
			break;

		case NN_rdtsc:               // Read Time Stamp Counter
			return this->BuildOptType8RTL();

		case NN_rsm:                 // Resume from System Management Mode
			NopRT = new SMPRegTransfer;
			NopRT->SetOperator(SMP_NULL_OPERATOR);
			this->RTL.push_back(NopRT);
			NopRT = NULL;
			return true;


		//
		//      Pentium Pro instructions
		//

		case NN_cmova:               // Move if Above (CF=0 & ZF=0)
		case NN_cmovb:               // Move if Below (CF=1)
		case NN_cmovbe:              // Move if Below or Equal (CF=1 | ZF=1)
			return this->BuildMoveRTL(SMP_BINARY_NUMERIC_OPERATION);

		case NN_cmovg:               // Move if Greater (ZF=0 & SF=OF)
			return this->BuildMoveRTL(SMP_GREATER_THAN);

		case NN_cmovge:              // Move if Greater or Equal (SF=OF)
			return this->BuildMoveRTL(SMP_GREATER_EQUAL);

		case NN_cmovl:               // Move if Less (SF!=OF)
			return this->BuildMoveRTL(SMP_LESS_THAN);

		case NN_cmovle:              // Move if Less or Equal (ZF=1 | SF!=OF)
			return this->BuildMoveRTL(SMP_LESS_EQUAL);

		case NN_cmovnb:              // Move if Not Below (CF=0)
		case NN_cmovno:              // Move if Not Overflow (OF=0)
		case NN_cmovnp:              // Move if Not Parity (PF=0)
		case NN_cmovns:              // Move if Not Sign (SF=0)
			return this->BuildMoveRTL(SMP_BINARY_NUMERIC_OPERATION);

		case NN_cmovnz:              // Move if Not Zero (ZF=0)
			return this->BuildMoveRTL(SMP_NOT_EQUAL);

		case NN_cmovo:               // Move if Overflow (OF=1)
		case NN_cmovp:               // Move if Parity (PF=1)
		case NN_cmovs:               // Move if Sign (SF=1)
			return this->BuildMoveRTL(SMP_BINARY_NUMERIC_OPERATION);

		case NN_cmovz:               // Move if Zero (ZF=1)
			return this->BuildMoveRTL(SMP_EQUAL);

		case NN_fcmovb:              // Floating Move if Below
			return this->BuildMoveRTL(SMP_BINARY_NUMERIC_OPERATION);

		case NN_fcmove:              // Floating Move if Equal
			return this->BuildMoveRTL(SMP_EQUAL);

		case NN_fcmovbe:             // Floating Move if Below or Equal
			return this->BuildMoveRTL(SMP_BINARY_NUMERIC_OPERATION);

		case NN_fcmovu:              // Floating Move if Unordered
			return this->BuildMoveRTL(SMP_BINARY_NUMERIC_OPERATION);

		case NN_fcmovnb:             // Floating Move if Not Below
			return this->BuildMoveRTL(SMP_BINARY_NUMERIC_OPERATION);

		case NN_fcmovne:             // Floating Move if Not Equal
			return this->BuildMoveRTL(SMP_NOT_EQUAL);

		case NN_fcmovnbe:            // Floating Move if Not Below or Equal
			return this->BuildMoveRTL(SMP_BINARY_NUMERIC_OPERATION);

		case NN_fcmovnu:             // Floating Move if Not Unordered
			return this->BuildMoveRTL(SMP_BINARY_NUMERIC_OPERATION);


		case NN_fcomi:               // FP Compare: result in EFLAGS
		case NN_fucomi:              // FP Unordered Compare: result in EFLAGS
		case NN_fcomip:              // FP Compare: result in EFLAGS: pop stack
		case NN_fucomip:             // FP Unordered Compare: result in EFLAGS: pop stack
			return false;
			break;

		case NN_rdpmc:               // Read Performance Monitor Counter
			return this->BuildOptType8RTL();

		//
		//      FPP instructions
		//

		case NN_fld:                 // Load Real
		case NN_fst:                 // Store Real
		case NN_fstp:                // Store Real and Pop
			return this->BuildMoveRTL(SMP_NULL_OPERATOR);

		case NN_fxch:                // Exchange Registers
			// FP registers remain NUMERIC anyway, so this is a no-op to our type system.
			NopRT = new SMPRegTransfer;
			NopRT->SetOperator(SMP_NULL_OPERATOR);
			this->RTL.push_back(NopRT);
			NopRT = NULL;
			return true;

		case NN_fild:                // Load Integer
		case NN_fist:                // Store Integer
		case NN_fistp:               // Store Integer and Pop
		case NN_fbld:                // Load BCD
		case NN_fbstp:               // Store BCD and Pop
			return this->BuildMoveRTL(SMP_NULL_OPERATOR);

		case NN_fadd:                // Add Real
		case NN_faddp:               // Add Real and Pop
		case NN_fiadd:               // Add Integer
		case NN_fsub:                // Subtract Real
		case NN_fsubp:               // Subtract Real and Pop
		case NN_fisub:               // Subtract Integer
		case NN_fsubr:               // Subtract Real Reversed
		case NN_fsubrp:              // Subtract Real Reversed and Pop
		case NN_fisubr:              // Subtract Integer Reversed
		case NN_fmul:                // Multiply Real
		case NN_fmulp:               // Multiply Real and Pop
		case NN_fimul:               // Multiply Integer
		case NN_fdiv:                // Divide Real
		case NN_fdivp:               // Divide Real and Pop
		case NN_fidiv:               // Divide Integer
		case NN_fdivr:               // Divide Real Reversed
		case NN_fdivrp:              // Divide Real Reversed and Pop
		case NN_fidivr:              // Divide Integer Reversed
			return this->BuildBinaryRTL(SMP_BINARY_FLOATING_ARITHMETIC);

		case NN_fsqrt:               // Square Root
		case NN_fscale:              // Scale:  st(0) <- st(0) * 2^st(1)
		case NN_fprem:               // Partial Remainder
		case NN_frndint:             // Round to Integer
		case NN_fxtract:             // Extract exponent and significand
		case NN_fabs:                // Absolute value
		case NN_fchs:                // Change Sign
			return this->BuildUnaryRTL(SMP_UNARY_FLOATING_ARITHMETIC);

		case NN_fcom:                // Compare Real
		case NN_fcomp:               // Compare Real and Pop
		case NN_fcompp:              // Compare Real and Pop Twice
		case NN_ficom:               // Compare Integer
		case NN_ficomp:              // Compare Integer and Pop
		case NN_ftst:                // Test
		case NN_fxam:                // Examine
			// Floating comparison instructions use FP reg stack locations
			//  as sources and set only the FP flags. All of these are numeric
			//  type and we don't track any of them, so all such instructions
			//  can be considered to be no-ops.
			NopRT = new SMPRegTransfer;
			NopRT->SetOperator(SMP_NULL_OPERATOR);
			this->RTL.push_back(NopRT);
			NopRT = NULL;
			return true;

		case NN_fptan:               // Partial tangent
		case NN_fpatan:              // Partial arctangent
		case NN_f2xm1:               // 2^x - 1
		case NN_fyl2x:               // Y * lg2(X)
		case NN_fyl2xp1:             // Y * lg2(X+1)
			// We can consider it a unary operation when both arguments come
			//  off the floating point register stack, unless we even start
			//  modeling the different locations in the FP register stack.
			return this->BuildUnaryRTL(SMP_UNARY_FLOATING_ARITHMETIC);

		case NN_fldz:                // Load +0.0
		case NN_fld1:                // Load +1.0
		case NN_fldpi:               // Load PI=3.14...
		case NN_fldl2t:              // Load lg2(10)
		case NN_fldl2e:              // Load lg2(e)
		case NN_fldlg2:              // Load lg10(2)
		case NN_fldln2:              // Load ln(2)
		case NN_finit:               // Initialize Processor
		case NN_fninit:              // Initialize Processor (no wait)
		case NN_fsetpm:              // Set Protected Mode
		case NN_fldcw:               // Load Control Word
		case NN_fstcw:               // Store Control Word
		case NN_fnstcw:              // Store Control Word (no wait)
		case NN_fstsw:               // Store Status Word
		case NN_fnstsw:              // Store Status Word (no wait)
		case NN_fclex:               // Clear Exceptions
		case NN_fnclex:              // Clear Exceptions (no wait)
			// Floating point stack and control word and flags operations
			//  with no memory operands are no-ops to us.
			NopRT = new SMPRegTransfer;
			NopRT->SetOperator(SMP_NULL_OPERATOR);
			this->RTL.push_back(NopRT);
			NopRT = NULL;
			return true;

		case NN_fstenv:              // Store Environment
		case NN_fnstenv:             // Store Environment (no wait)
		case NN_fldenv:              // Load Environment
		case NN_fsave:               // Save State
		case NN_fnsave:              // Save State (no wait)
		case NN_frstor:              // Restore State
		case NN_fincstp:             // Increment Stack Pointer
		case NN_fdecstp:             // Decrement Stack Pointer
		case NN_ffree:               // Free Register
		case NN_fnop:                // No Operation
		case NN_feni:                // (8087 only)
		case NN_fneni:               // (no wait) (8087 only)
		case NN_fdisi:               // (8087 only)
		case NN_fndisi:              // (no wait) (8087 only)
			return false;
			break;


		//
		//      80387 instructions
		//

		case NN_fprem1:              // Partial Remainder ( < half )
		case NN_fsincos:             // t<-cos(st); st<-sin(st); push t
		case NN_fsin:                // Sine
		case NN_fcos:                // Cosine
		case NN_fucom:               // Compare Unordered Real
		case NN_fucomp:              // Compare Unordered Real and Pop
		case NN_fucompp:             // Compare Unordered Real and Pop Twice
			// Floating point stack and control word and flags operations
			//  with no memory operands are no-ops to us.
			NopRT = new SMPRegTransfer;
			NopRT->SetOperator(SMP_NULL_OPERATOR);
			this->RTL.push_back(NopRT);
			NopRT = NULL;
			return true;


		//
		//      Instructions added 28.02.96
		//

		case NN_setalc:              // Set AL to Carry Flag
		case NN_svdc:                // Save Register and Descriptor
		case NN_rsdc:                // Restore Register and Descriptor
		case NN_svldt:               // Save LDTR and Descriptor
		case NN_rsldt:               // Restore LDTR and Descriptor
		case NN_svts:                // Save TR and Descriptor
		case NN_rsts:                // Restore TR and Descriptor
		case NN_icebp:               // ICE Break Point
		case NN_loadall:             // Load the entire CPU state from ES:EDI

		//
		//      MMX instructions
		//

		case NN_emms:                // Empty MMX state
		case NN_movd:                // Move 32 bits
		case NN_movq:                // Move 64 bits
		case NN_packsswb:            // Pack with Signed Saturation (Word->Byte)
		case NN_packssdw:            // Pack with Signed Saturation (Dword->Word)
		case NN_packuswb:            // Pack with Unsigned Saturation (Word->Byte)
		case NN_paddb:               // Packed Add Byte
		case NN_paddw:               // Packed Add Word
		case NN_paddd:               // Packed Add Dword
		case NN_paddsb:              // Packed Add with Saturation (Byte)
		case NN_paddsw:              // Packed Add with Saturation (Word)
		case NN_paddusb:             // Packed Add Unsigned with Saturation (Byte)
		case NN_paddusw:             // Packed Add Unsigned with Saturation (Word)
		case NN_pand:                // Bitwise Logical And
		case NN_pandn:               // Bitwise Logical And Not
		case NN_pcmpeqb:             // Packed Compare for Equal (Byte)
		case NN_pcmpeqw:             // Packed Compare for Equal (Word)
		case NN_pcmpeqd:             // Packed Compare for Equal (Dword)
		case NN_pcmpgtb:             // Packed Compare for Greater Than (Byte)
		case NN_pcmpgtw:             // Packed Compare for Greater Than (Word)
		case NN_pcmpgtd:             // Packed Compare for Greater Than (Dword)
		case NN_pmaddwd:             // Packed Multiply and Add
		case NN_pmulhw:              // Packed Multiply High
		case NN_pmullw:              // Packed Multiply Low
		case NN_por:                 // Bitwise Logical Or
		case NN_psllw:               // Packed Shift Left Logical (Word)
		case NN_pslld:               // Packed Shift Left Logical (Dword)
		case NN_psllq:               // Packed Shift Left Logical (Qword)
		case NN_psraw:               // Packed Shift Right Arithmetic (Word)
		case NN_psrad:               // Packed Shift Right Arithmetic (Dword)
		case NN_psrlw:               // Packed Shift Right Logical (Word)
		case NN_psrld:               // Packed Shift Right Logical (Dword)