SMPInstr.cpp

// Build the RTL for a direct or indirect call instruction
bool SMPInstr::BuildCallRTL(void) {
	size_t OpNum;
	bool SourceFound = false;
	op_t VoidOp;
	VoidOp.type = o_void;
	SMPRegTransfer *TempRT = NULL;

	for (OpNum = 0; !SourceFound && (OpNum < UA_MAXOP); ++OpNum) {
		op_t TempOp = this->SMPcmd.Operands[OpNum];
		if (this->features & DefMacros[OpNum]) { // DEF
			if (MDKnownOperandType(TempOp)) {
#if SMP_DEBUG_BUILD_RTL
				msg("ERROR: Found destination operand for call at %x : %s\n",
					this->GetAddr(), this->GetDisasm());
#endif
			}
		}
		else { // USE
			if (MDKnownOperandType(TempOp)) {
				SourceFound = true;
				TempRT = new SMPRegTransfer;
				TempRT->SetLeftOperand(VoidOp);
				TempRT->SetOperator(SMP_CALL);
				TempRT->SetRightOperand(TempOp);
			}
		}
	} // end for (OpNum = 0; ...)

	if (!SourceFound) {
#if SMP_DEBUG_BUILD_RTL
		msg("ERROR: Could not find CALL operand at %x for %s\n", this->GetAddr(), this->GetDisasm());
#endif
	}
	else {
		this->RTL.push_back(TempRT);
	}
	return SourceFound;
} // end of SMPInstr::BuildCallRTL()

// Build the RTL for a return instruction, with or without extra bytes popped off stack
bool SMPInstr::BuildReturnRTL(void) {
	size_t OpNum;
	uval_t PopBytes = 4;  // default: pop off return address

	for (OpNum = 0; OpNum < UA_MAXOP; ++OpNum) {
		op_t TempOp = this->SMPcmd.Operands[OpNum];
		if (this->features & DefMacros[OpNum]) { // DEF
			if (MDKnownOperandType(TempOp)) {
#if SMP_DEBUG_BUILD_RTL
				msg("ERROR: Found destination operand for RET at %x : %s\n",
					this->GetAddr(), this->GetDisasm());
#endif
			}
		}
		else { // USE
			if (MDKnownOperandType(TempOp)) {
				if (o_imm == TempOp.type) {
					PopBytes += TempOp.value;
				}
				else {
#if SMP_DEBUG_BUILD_RTL
					if (!(this->IsTailCall())) {
						msg("ERROR: Found unexpected operand for return at %x : %s\n",
							this->GetAddr(), this->GetDisasm());
					}
#endif
				}
			}
		}
	} // end for (OpNum = 0; ...)

	this->AddToStackPointer(PopBytes);
	return true;
} // end of SMPInstr::BuildReturnRTL()

// Build the RTL for an ENTER instruction
bool SMPInstr::BuildEnterRTL(void) {
	// An "ENTER k,0" instruction with allocation k and nesting level 0 does the following:
	//  push ebp
	//  mov ebp,esp
	//  sub esp,k
	// This can be modeled by the parallel effects:
	//  [esp-4] := ebp; ebp := esp - 4; esp := esp - k
	// If nesting level is greater than zero, we have a block structure language with
	//  nested procedures, in which additional frame pointers are saved:
	// "ENTER k,n" pushes n additional frame pointers on the stack. We will only model
	//  the change in the stack pointer here, and not attempt to transfer the display
	//  pointers. A warning will be issued to the log file. Parallel effects are:
	//  [esp-4] := ebp; ebp := esp - 4; esp := esp - (k + n*4)
	// Note that k and n and immediate values so the final expression can be computed.
	size_t OpNum;
	uval_t NestingLevel = 0;
	uval_t AllocBytes = 0;
	bool AllocFound = false;
	bool NestingLevelFound = false;

	op_t StackPointerOp;          // ESP
	StackPointerOp.type = o_reg;
	StackPointerOp.reg = R_sp;

	op_t FramePointerOp;          // EBP
	FramePointerOp.type = o_reg;
	FramePointerOp.reg = R_bp;

	op_t Immed4Op;                // 4
	Immed4Op.type = o_imm;
	Immed4Op.value = 4;
	Immed4Op.dtyp = dt_dword;

	op_t SavedEBP;                // [ESP-4], location of saved EBP
	SavedEBP.type = o_displ;
	SavedEBP.addr = (ea_t) -4;
	SavedEBP.dtyp = dt_dword;
	SavedEBP.reg = R_sp;
	SavedEBP.hasSIB = 0;

	for (OpNum = 0; !(AllocFound && NestingLevelFound) && (OpNum < UA_MAXOP); ++OpNum) {
		op_t TempOp = this->SMPcmd.Operands[OpNum];
		if (this->features & DefMacros[OpNum]) { // DEF
			if (MDKnownOperandType(TempOp)) {
#if SMP_DEBUG_BUILD_RTL
				msg("ERROR: Found destination operand for ENTER at %x : %s\n",
					this->GetAddr(), this->GetDisasm());
#endif
			}
		}
		else { // USE
			if (MDKnownOperandType(TempOp)) {
				if (o_imm == TempOp.type) {
					if (!AllocFound) {
						AllocBytes = TempOp.value;
						AllocFound = true;
					}
					else {
						NestingLevel = TempOp.value;
						NestingLevelFound = true;
					}
				}
				else {
#if SMP_DEBUG_BUILD_RTL
					msg("ERROR: Found unexpected operand for ENTER at %x : %s\n",
						this->GetAddr(), this->GetDisasm());
#endif
				}
			}
		}
	} // end for (OpNum = 0; ...)

	if (!AllocFound) {
#if SMP_DEBUG_BUILD_RTL
		msg("ERROR: Could not find allocation operand for ENTER at %x : %s\n",
			this->GetAddr(), this->GetDisasm());
#endif
	}
	else {
		SMPRegTransfer *TempRT = new SMPRegTransfer;

		// Add first effect: [esp-4] := ebp
		TempRT->SetLeftOperand(SavedEBP);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetRightOperand(FramePointerOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// Add second effect: ebp := esp - 4
		TempRT = new SMPRegTransfer;
		TempRT->SetLeftOperand(FramePointerOp);
		TempRT->SetOperator(SMP_ASSIGN);
		SMPRegTransfer *RightRT = new SMPRegTransfer;
		RightRT->SetLeftOperand(StackPointerOp);
		RightRT->SetOperator(SMP_SUBTRACT);
		RightRT->SetRightOperand(Immed4Op);
		TempRT->SetRightTree(RightRT);
		this->RTL.push_back(TempRT);
		TempRT = NULL;
		RightRT = NULL;

		// Add final effect on stack pointer
		AllocBytes += (4 * NestingLevel);
		if (0 != NestingLevel) {
			msg("WARNING: Nested procedures in ENTER instruction at %x : %s\n",
				this->GetAddr(), this->GetDisasm());
		}
		this->AddToStackPointer(AllocBytes);
	}
	return AllocFound;
} // end of SMPInstr::BuildEnterRTL()

// Build the RTL for an LEAVE instruction
bool SMPInstr::BuildLeaveRTL(void) {
	// A LEAVE instruction simulates the following instructions:
	//  mov ebp into esp (deallocates stack frame)
	//  pop saved ebp off stack into ebp
	// We will model these two instructions with three parallel effects:
	//  esp := ebp; ebp := [ebp+0]; esp = esp + 4;
	// There cannot be two definitions of esp in the list of effects, so we do:
	//  esp := ebp + 4; ebp := [ebp+0] as our two parallel effects
	op_t StackPointerOp;          // ESP
	StackPointerOp.type = o_reg;
	StackPointerOp.reg = R_sp;

	op_t FramePointerOp;          // EBP
	FramePointerOp.type = o_reg;
	FramePointerOp.reg = R_bp;

	op_t Immed4Op;                // 4
	Immed4Op.type = o_imm;
	Immed4Op.value = 4;
	Immed4Op.dtyp = dt_dword;

	op_t SavedEBP;                // [EBP+0]
	SavedEBP.type = o_displ;
	SavedEBP.addr = 0;
	SavedEBP.dtyp = dt_dword;
	SavedEBP.reg = R_bp;
	SavedEBP.hasSIB = 0;

	// Build first effect:  ESP := EBP + 4
	SMPRegTransfer *TempRT = new SMPRegTransfer;
	TempRT->SetLeftOperand(StackPointerOp);
	TempRT->SetOperator(SMP_ASSIGN);
	SMPRegTransfer *RightRT = new SMPRegTransfer;
	RightRT->SetOperator(SMP_ADD);
	RightRT->SetLeftOperand(FramePointerOp);
	RightRT->SetRightOperand(Immed4Op);
	TempRT->SetRightTree(RightRT);
	this->RTL.push_back(TempRT);
	TempRT = NULL;
	RightRT = NULL;

	// Build second effect: EBP := [EBP+0]
	TempRT = new SMPRegTransfer;
	TempRT->SetLeftOperand(FramePointerOp);
	TempRT->SetOperator(SMP_ASSIGN);
	TempRT->SetRightOperand(SavedEBP);
	this->RTL.push_back(TempRT);
	TempRT = NULL;

	return true;
} // end of SMPInstr::BuildLeaveRTL()

// Build OptCategory 8 RTLs, which set system info into EDX:EAX.
bool SMPInstr::BuildOptType8RTL(void) {
	op_t DestOp;
	DestOp.type = o_reg;

	op_t VoidOp;
	VoidOp.type = o_void;

	// Create the effect on EDX.
	SMPRegTransfer *TempRT = new SMPRegTransfer;
	DestOp.reg = R_dx;
	TempRT->SetLeftOperand(DestOp);
	TempRT->SetOperator(SMP_ASSIGN);
	SMPRegTransfer *RightRT =  new SMPRegTransfer;
	RightRT->SetLeftOperand(VoidOp);
	RightRT->SetOperator(SMP_SYSTEM_OPERATION);
	RightRT->SetRightOperand(VoidOp);
	TempRT->SetRightTree(RightRT);
	this->RTL.push_back(TempRT);

	// Create the effect on EAX.
	TempRT = NULL;
	RightRT = NULL;
	TempRT = new SMPRegTransfer;
	DestOp.reg = R_ax;
	TempRT->SetLeftOperand(DestOp);
	TempRT->SetOperator(SMP_ASSIGN);
	RightRT = new SMPRegTransfer;
	RightRT->SetLeftOperand(VoidOp);
	RightRT->SetOperator(SMP_SYSTEM_OPERATION);
	RightRT->SetRightOperand(VoidOp);
	TempRT->SetRightTree(RightRT);
	this->RTL.push_back(TempRT);

	return true;
} // end of BuildOptType8RTL()

// Build the RTL for a direct or indirect jump instruction
bool SMPInstr::BuildJumpRTL(SMPoperator CondBranchOp) {
	size_t OpNum;
	bool TargetFound = false;
	SMPRegTransfer *TempRT = NULL;
	op_t EIPOp, ZeroOp, FlagsOp;

	EIPOp.type = o_reg;
	EIPOp.reg = R_ip;

	ZeroOp.type = o_imm;
	ZeroOp.value = 0;

	FlagsOp.type = o_reg;
	FlagsOp.reg = X86_FLAGS_REG;

	op_t CountOp;
	CountOp.type = o_reg;
	CountOp.reg = R_cx;

	if (this->IsTailCall())
		return this->BuildReturnRTL();

	for (OpNum = 0; !TargetFound && (OpNum < UA_MAXOP); ++OpNum) {
		op_t TempOp = this->SMPcmd.Operands[OpNum];
		if (this->features & UseMacros[OpNum]) { // USE
			if (MDKnownOperandType(TempOp)) {
				TargetFound = true;
				TempRT = new SMPRegTransfer;
				TempRT->SetLeftOperand(EIPOp);
				TempRT->SetOperator(SMP_ASSIGN);
				TempRT->SetRightOperand(TempOp);
				if (CondBranchOp != SMP_NULL_OPERATOR) {
					// Set up a guard expression comparing EFLAGS to zero.
					// NOTE: This is imprecise for value-set purposes, but OK for types.
					SMPGuard *BranchCondition = new SMPGuard;
					BranchCondition->SetOperator(CondBranchOp);
					// The conditional jumps on ECX==0 compare to ECX, not EFLAGS.
					if ((NN_jcxz <= this->SMPcmd.itype) && (NN_jrcxz >= this->SMPcmd.itype))
						BranchCondition->SetLeftOperand(CountOp);
					else
						BranchCondition->SetLeftOperand(FlagsOp);
					BranchCondition->SetRightOperand(ZeroOp);
					TempRT->SetGuard(BranchCondition);
				}
				this->RTL.push_back(TempRT);
			}
		}
	} // end for (OpNum = 0; ...)

#if SMP_DEBUG_BUILD_RTL
	if (!TargetFound) {
		msg("ERROR: Could not find jump target at %x for %s\n", this->GetAddr(), this->GetDisasm());
	}
#endif
	return TargetFound;
} // end of SMPInstr::BuildJumpRTL()

// Add to the stack pointer to deallocate stack space, e.g. for a pop instruction.
void SMPInstr::AddToStackPointer(uval_t delta) {
	SMPRegTransfer *TempRT = new SMPRegTransfer;
	SMPRegTransfer *RightRT = new SMPRegTransfer;
	op_t StackOp, DeltaOp;

	StackOp.type = o_reg;
	StackOp.reg = R_sp;
	StackOp.addr = 0;
	StackOp.hasSIB = 0;
	StackOp.dtyp = dt_dword;

	DeltaOp.type = o_imm;
	DeltaOp.value = delta;

	TempRT->SetLeftOperand(StackOp);    // ESP := RightRT
	TempRT->SetOperator(SMP_ASSIGN); 
	RightRT->SetLeftOperand(StackOp); // ESP + delta
	RightRT->SetOperator(SMP_ADD);
	RightRT->SetRightOperand(DeltaOp);
	TempRT->SetRightTree(RightRT);
	this->RTL.push_back(TempRT);
	return;
} // end of SMPInstr::AddToStackPointer()

// Add to the stack pointer to deallocate stack space, e.g. for a pop instruction.
void SMPInstr::SubFromStackPointer(uval_t delta) {
	SMPRegTransfer *TempRT = new SMPRegTransfer;
	SMPRegTransfer *RightRT = new SMPRegTransfer;
	op_t StackOp, DeltaOp;

	StackOp.type = o_reg;
	StackOp.reg = R_sp;
	StackOp.addr = 0;
	StackOp.hasSIB = 0;
	StackOp.dtyp = dt_dword;

	DeltaOp.type = o_imm;
	DeltaOp.value = delta;

	TempRT->SetLeftOperand(StackOp);    // ESP := RightRT
	TempRT->SetOperator(SMP_ASSIGN);
	RightRT->SetLeftOperand(StackOp); // ESP - delta
	RightRT->SetOperator(SMP_SUBTRACT);
	RightRT->SetRightOperand(DeltaOp);
	TempRT->SetRightTree(RightRT);
	this->RTL.push_back(TempRT);
	return;
} // end of SMPInstr::SubFromStackPointer()

#define SMP_FIRST_POP_FLAGS  NN_popfw
#define SMP_LAST_POP_FLAGS  NN_popfq
#define SMP_FIRST_POP_ALL  NN_popaw
#define SMP_LAST_POP_ALL  NN_popaq
// Build the RTL for a pop instruction
bool SMPInstr::BuildPopRTL(void) {
	size_t OpNum, OpSize;
	bool DestFound = false;
	SMPRegTransfer *TempRT = NULL;
	op_t StackOp, FlagsOp;
	StackOp.type = o_displ;
	StackOp.reg = R_sp;
	StackOp.addr = 0;  // [ESP+0]
	StackOp.hasSIB = 0;
	StackOp.dtyp = dt_dword;
	FlagsOp.type = o_reg;
	FlagsOp.reg = X86_FLAGS_REG;
	FlagsOp.dtyp = dt_dword;

	// Handle special cases first.
	if ((SMP_FIRST_POP_FLAGS <= this->SMPcmd.itype) && (SMP_LAST_POP_FLAGS >= this->SMPcmd.itype)) {
		TempRT = new SMPRegTransfer;
		TempRT->SetLeftOperand(FlagsOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetRightOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;
		// Now create the stack pointer increment effect.
		this->AddToStackPointer(4);
		return true;
	}

	if ((SMP_FIRST_POP_ALL <= this->SMPcmd.itype) && (SMP_LAST_POP_ALL >= this->SMPcmd.itype)) {
		// We pop off 7 registers from the 8 that were pushed on the stack.
		//  The pushed stack pointer is ignored. Instead, the stack pointer value is
		//  adjusted at the end, per the Intel instruction manuals.

		op_t RegOp;
		RegOp.type = o_reg;

		// EDI comes from [ESP+0]
		RegOp.reg = R_di;
		StackOp.addr = 0;  // [ESP+0]
		TempRT = new SMPRegTransfer;
		TempRT->SetLeftOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetRightOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// ESI comes from [ESP+4]
		RegOp.reg = R_si;
		StackOp.addr = 4;  // [ESP+4]
		TempRT = new SMPRegTransfer;
		TempRT->SetLeftOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetRightOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// EBP comes from [ESP+8]
		RegOp.reg = R_bp;
		StackOp.addr = 8;  // [ESP+8]
		TempRT = new SMPRegTransfer;
		TempRT->SetLeftOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetRightOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// Skip over saved ESP at [ESP+12]

		// EBX comes from [ESP+16]
		RegOp.reg = R_bx;
		StackOp.addr = 16;  // [ESP+16]
		TempRT = new SMPRegTransfer;
		TempRT->SetLeftOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetRightOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// EDX comes from [ESP+20]
		RegOp.reg = R_dx;
		StackOp.addr = 20;  // [ESP+20]
		TempRT = new SMPRegTransfer;
		TempRT->SetLeftOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetRightOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// ECX comes from [ESP+24]
		RegOp.reg = R_cx;
		StackOp.addr = 24;  // [ESP+24]
		TempRT = new SMPRegTransfer;
		TempRT->SetLeftOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetRightOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// EAX comes from [ESP+28]
		RegOp.reg = R_ax;
		StackOp.addr = 28;  // [ESP+28]
		TempRT = new SMPRegTransfer;
		TempRT->SetLeftOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetRightOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// Now create the stack pointer increment effect.
		this->AddToStackPointer(32);
		return true;
	} // end for "pop all" instructions

	// If we reach this point, we have a simple POP instruction.
	for (OpNum = 0; !DestFound && (OpNum < UA_MAXOP); ++OpNum) {
		op_t TempOp = this->SMPcmd.Operands[OpNum];
		if (this->features & DefMacros[OpNum]) { // DEF
			if (MDKnownOperandType(TempOp)) {
				DestFound = true;
				TempRT = new SMPRegTransfer;
				TempRT->SetLeftOperand(TempOp);
				TempRT->SetOperator(SMP_ASSIGN);
				StackOp.dtyp = TempOp.dtyp;  // size of transfer
				TempRT->SetRightOperand(StackOp);
				this->RTL.push_back(TempRT);
				// Now create the stack pointer increment effect.
				OpSize = GetOpDataSize(TempOp);
				this->AddToStackPointer((uval_t) OpSize);
			}
		}
	} // end for (OpNum = 0; ...)

#if SMP_DEBUG_BUILD_RTL
	if (!DestFound) {
		msg("ERROR: Could not find pop operand at %x for %s\n", this->GetAddr(), this->GetDisasm());
	}
#endif
	return DestFound;
} // end of SMPInstr::BuildPopRTL()

#define SMP_FIRST_PUSH_FLAGS  NN_pushfw
#define SMP_LAST_PUSH_FLAGS  NN_pushfq
#define SMP_FIRST_PUSH_ALL  NN_pushaw
#define SMP_LAST_PUSH_ALL  NN_pushaq
// Build the RTL for a push instruction
bool SMPInstr::BuildPushRTL(void) {
	size_t OpNum, OpSize;
	bool SourceFound = false;
	SMPRegTransfer *TempRT = NULL;
	op_t StackOp, FlagsOp;
	StackOp.type = o_displ;
	StackOp.reg = R_sp;
	StackOp.addr = (ea_t) -4;  // [ESP-4]
	StackOp.hasSIB = 0;
	StackOp.dtyp = dt_dword;
	FlagsOp.type = o_reg;
	FlagsOp.reg = X86_FLAGS_REG;
	FlagsOp.dtyp = dt_dword;

	// Handle special cases first.
	if ((SMP_FIRST_PUSH_FLAGS <= this->SMPcmd.itype) && (SMP_LAST_PUSH_FLAGS >= this->SMPcmd.itype)) {
		TempRT = new SMPRegTransfer;
		TempRT->SetRightOperand(FlagsOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetLeftOperand(StackOp);
		this->RTL.push_back(TempRT);
		// Now create the stack pointer increment effect.
		this->SubFromStackPointer(4);
		return true;
	}

	if ((SMP_FIRST_PUSH_ALL <= this->SMPcmd.itype) && (SMP_LAST_PUSH_ALL >= this->SMPcmd.itype)) {
		op_t RegOp;
		RegOp.type = o_reg;

		// EDI goes to [ESP-32]
		RegOp.reg = R_di;
		StackOp.addr = (ea_t) -32;  // [ESP-32]
		TempRT = new SMPRegTransfer;
		TempRT->SetRightOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetLeftOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// ESI goes to [ESP-28]
		RegOp.reg = R_si;
		StackOp.addr = (ea_t) -28;  // [ESP-28]
		TempRT = new SMPRegTransfer;
		TempRT->SetRightOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetLeftOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// EBP goes to [ESP-24]
		RegOp.reg = R_bp;
		StackOp.addr = (ea_t) -24;  // [ESP-24]
		TempRT = new SMPRegTransfer;
		TempRT->SetRightOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetLeftOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// ESP goes to [ESP-20]
		RegOp.reg = R_sp;
		StackOp.addr = (ea_t) -20;  // [ESP-20]
		TempRT = new SMPRegTransfer;
		TempRT->SetRightOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetLeftOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// EBX goes to [ESP-16]
		RegOp.reg = R_bx;
		StackOp.addr = (ea_t) -16;  // [ESP-16]
		TempRT = new SMPRegTransfer;
		TempRT->SetRightOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetLeftOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// EDX goes to [ESP-12]
		RegOp.reg = R_dx;
		StackOp.addr = (ea_t) -12;  // [ESP-12]
		TempRT = new SMPRegTransfer;
		TempRT->SetRightOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetLeftOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// ECX goes to [ESP-8]
		RegOp.reg = R_cx;
		StackOp.addr = (ea_t) -8;  // [ESP-8]
		TempRT = new SMPRegTransfer;
		TempRT->SetRightOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetLeftOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// EAX goes to [ESP-4]
		RegOp.reg = R_ax;
		StackOp.addr = (ea_t) -4;  // [ESP-4]
		TempRT = new SMPRegTransfer;
		TempRT->SetRightOperand(RegOp);
		TempRT->SetOperator(SMP_ASSIGN);
		TempRT->SetLeftOperand(StackOp);
		this->RTL.push_back(TempRT);
		TempRT = NULL;

		// Now create the stack pointer increment effect.
		this->SubFromStackPointer(32);
		return true;
	} // end for "pop all" instructions

	// If we reach this point, we have a simple PUSH instruction.
	for (OpNum = 0; !SourceFound && (OpNum < UA_MAXOP); ++OpNum) {
		op_t TempOp = this->SMPcmd.Operands[OpNum];
		if (this->features & UseMacros[OpNum]) { // USE
			if (MDKnownOperandType(TempOp)) {
				SourceFound = true;
				OpSize = GetOpDataSize(TempOp);
				TempRT = new SMPRegTransfer;
				TempRT->SetRightOperand(TempOp);
				TempRT->SetOperator(SMP_ASSIGN);
				StackOp.dtyp = TempOp.dtyp;  // size of transfer
				StackOp.addr = (ea_t) (-((signed int) OpSize));
				TempRT->SetLeftOperand(StackOp);
				this->RTL.push_back(TempRT);
				TempRT = NULL;
				// Now create the stack pointer increment effect.
				this->SubFromStackPointer((uval_t) OpSize);
#if 0
				this->RTL.Dump();
#endif
			}
		}
	} // end for (OpNum = 0; ...)

#if SMP_DEBUG_BUILD_RTL
	if (!SourceFound) {
		msg("ERROR: Could not find push operand at %x for %s\n", this->GetAddr(), this->GetDisasm());
	}
#endif
	return SourceFound;
} // end of SMPInstr::BuildPushRTL()

// Build RTL trees from the SMPcmd info.
bool SMPInstr::BuildRTL(void) {
	op_t FlagsOp;
	FlagsOp.type = o_reg;
	FlagsOp.reg = X86_FLAGS_REG;
	SMPRegTransfer *NopRT = NULL;  // no-op register transfer

	// We don't want to explicitly represent the various no-ops except as NULL operations.
	//  E.g. mov esi,esi should not generate DEF and USE of esi, because esi does not change.
	if (this->MDIsNop()) {
		NopRT = new SMPRegTransfer;
		NopRT->SetOperator(SMP_NULL_OPERATOR);
		this->RTL.push_back(NopRT);
		NopRT = NULL;
		return true;
	}

	switch (this->SMPcmd.itype) {
		case NN_aaa:                 // ASCII Adjust after Addition
		case NN_aad:                 // ASCII Adjust AX before Division
		case NN_aam:                 // ASCII Adjust AX after Multiply
		case NN_aas:                 // ASCII Adjust AL after Subtraction
			return this->BuildUnaryRTL(SMP_UNARY_NUMERIC_OPERATION);

		case NN_adc:                 // Add with Carry
			return this->BuildBinaryPlusFlagsRTL(SMP_ADD_CARRY);

		case NN_add:                 // Add
			return this->BuildBinaryRTL(SMP_ADD);

		case NN_and:                 // Logical AND
			return this->BuildBinaryRTL(SMP_BITWISE_AND);

		case NN_arpl:                // Adjust RPL Field of Selector
		case NN_bound:               // Check Array Index Against Bounds
			return false;
			break;

		case NN_bsf:                 // Bit Scan Forward
		case NN_bsr:                 // Bit Scan Reverse
			return this->BuildUnary2OpndRTL(SMP_UNARY_NUMERIC_OPERATION);

		case NN_bt:                  // Bit Test
			return this->BuildFlagsDestBinaryRTL(SMP_BINARY_NUMERIC_OPERATION);

		case NN_btc:                 // Bit Test and Complement
		case NN_btr:                 // Bit Test and Reset
		case NN_bts:                 // Bit Test and Set
			// Has effects on both the carry flag and the first operand
			this->RTL.ExtraKills.push_back(FlagsOp);
			return this->BuildBinaryRTL(SMP_BINARY_NUMERIC_OPERATION);

		case NN_call:                // Call Procedure
		case NN_callfi:              // Indirect Call Far Procedure
		case NN_callni:              // Indirect Call Near Procedure
			return this->BuildCallRTL();

		case NN_cbw:                 // AL -> AX (with sign)
		case NN_cwde:                // AX -> EAX (with sign)
		case NN_cdqe:                // EAX -> RAX (with sign)
			return this->BuildUnaryRTL(SMP_SIGN_EXTEND);

		case NN_clc:                 // Clear Carry Flag
		case NN_cld:                 // Clear Direction Flag
			return this->BuildUnaryRTL(SMP_UNARY_NUMERIC_OPERATION);

		case NN_cli:                 // Clear Interrupt Flag
		case NN_clts:                // Clear Task-Switched Flag in CR0
			// We don't track the interrupt flag or the special registers,
			//  so we can just consider these to be no-ops.
			NopRT = new SMPRegTransfer;
			NopRT->SetOperator(SMP_NULL_OPERATOR);
			this->RTL.push_back(NopRT);
			NopRT = NULL;
			return true;

		case NN_cmc:                 // Complement Carry Flag
			return this->BuildUnaryRTL(SMP_UNARY_NUMERIC_OPERATION);

		case NN_cmp:                 // Compare Two Operands
			return this->BuildFlagsDestBinaryRTL(SMP_S_COMPARE);

		case NN_cmps:                // Compare Strings
			return this->BuildFlagsDestBinaryRTL(SMP_U_COMPARE);

		case NN_cwd:                 // AX -> DX:AX (with sign)
		case NN_cdq:                 // EAX -> EDX:EAX (with sign)
		case NN_cqo:                 // RAX -> RDX:RAX (with sign)
			return this->BuildUnary2OpndRTL(SMP_SIGN_EXTEND);

		case NN_daa:                 // Decimal Adjust AL after Addition
		case NN_das:                 // Decimal Adjust AL after Subtraction
			return this->BuildUnaryRTL(SMP_UNARY_NUMERIC_OPERATION);

		case NN_dec:                 // Decrement by 1
			return this->BuildUnaryRTL(SMP_DECREMENT);

		case NN_div:                 // Unsigned Divide
			return this->BuildMultiplyDivideRTL(SMP_U_DIVIDE);

		case NN_enterw:              // Make Stack Frame for Procedure Parameters
		case NN_enter:               // Make Stack Frame for Procedure Parameters
		case NN_enterd:              // Make Stack Frame for Procedure Parameters
		case NN_enterq:              // Make Stack Frame for Procedure Parameters
			return this->BuildEnterRTL();

		case NN_hlt:                 // Halt
			// Treat as a no-op
			NopRT = new SMPRegTransfer;
			NopRT->SetOperator(SMP_NULL_OPERATOR);
			this->RTL.push_back(NopRT);
			NopRT = NULL;
			return true;

		case NN_idiv:                // Signed Divide
			return this->BuildMultiplyDivideRTL(SMP_S_DIVIDE);

		case NN_imul:                // Signed Multiply
			return this->BuildMultiplyDivideRTL(SMP_S_MULTIPLY);

		case NN_in:                  // Input from Port
			return this->BuildUnary2OpndRTL(SMP_INPUT);

		case NN_inc:                 // Increment by 1
			return this->BuildUnaryRTL(SMP_INCREMENT);

		case NN_ins:                 // Input Byte(s) from Port to String
			return false;
			break;

		case NN_int:                 // Call to Interrupt Procedure
		case NN_into:                // Call to Interrupt Procedure if Overflow Flag = 1
		case NN_int3:                // Trap to Debugger
			return this->BuildCallRTL();

		case NN_iretw:               // Interrupt Return
		case NN_iret:                // Interrupt Return
		case NN_iretd:               // Interrupt Return (use32)
		case NN_iretq:               // Interrupt Return (use64)
			return this->BuildReturnRTL();

		case NN_ja:                  // Jump if Above (CF=0 & ZF=0)
		case NN_jae:                 // Jump if Above or Equal (CF=0)
		case NN_jb:                  // Jump if Below (CF=1)
		case NN_jbe:                 // Jump if Below or Equal (CF=1 | ZF=1)
		case NN_jc:                  // Jump if Carry (CF=1)
			return this->BuildJumpRTL(SMP_BINARY_NUMERIC_OPERATION);

		case NN_jcxz:                // Jump if CX is 0
		case NN_jecxz:               // Jump if ECX is 0
		case NN_jrcxz:               // Jump if RCX is 0
			return this->BuildJumpRTL(SMP_EQUAL); // special case in BuildJumpRTL()

		case NN_je:                  // Jump if Equal (ZF=1)
			return this->BuildJumpRTL(SMP_EQUAL);

		case NN_jg:                  // Jump if Greater (ZF=0 & SF=OF)
			return this->BuildJumpRTL(SMP_GREATER_THAN);

		case NN_jge:                 // Jump if Greater or Equal (SF=OF)
			return this->BuildJumpRTL(SMP_GREATER_EQUAL);

		case NN_jl:                  // Jump if Less (SF!=OF)
			return this->BuildJumpRTL(SMP_LESS_THAN);

		case NN_jle:                 // Jump if Less or Equal (ZF=1 | SF!=OF)
			return this->BuildJumpRTL(SMP_LESS_EQUAL);

		case NN_jna:                 // Jump if Not Above (CF=1 | ZF=1)
		case NN_jnae:                // Jump if Not Above or Equal (CF=1)
		case NN_jnb:                 // Jump if Not Below (CF=0)
		case NN_jnbe:                // Jump if Not Below or Equal (CF=0 & ZF=0) a.k.a. ja
		case NN_jnc:                 // Jump if Not Carry (CF=0)
			return this->BuildJumpRTL(SMP_BINARY_NUMERIC_OPERATION);

		case NN_jne:                 // Jump if Not Equal (ZF=0)
			return this->BuildJumpRTL(SMP_NOT_EQUAL);

		case NN_jng:                 // Jump if Not Greater (ZF=1 | SF!=OF) a.k.a. jle
			return this->BuildJumpRTL(SMP_LESS_EQUAL);

		case NN_jnge:                // Jump if Not Greater or Equal (SF != OF) **
			return this->BuildJumpRTL(SMP_LESS_THAN);

		case NN_jnl:                 // Jump if Not Less (SF=OF) a.k.a. jge
			return this->BuildJumpRTL(SMP_GREATER_EQUAL);

		case NN_jnle:                // Jump if Not Less or Equal (ZF=0 & SF=OF) a.k.a. jg
			return this->BuildJumpRTL(SMP_GREATER_THAN);

		case NN_jno:                 // Jump if Not Overflow (OF=0)
		case NN_jnp:                 // Jump if Not Parity (PF=0)
		case NN_jns:                 // Jump if Not Sign (SF=0)
			return this->BuildJumpRTL(SMP_BINARY_NUMERIC_OPERATION);

		case NN_jnz:                 // Jump if Not Zero (ZF=0)  a.k.a. jne
			return this->BuildJumpRTL(SMP_NOT_EQUAL);

		case NN_jo:                  // Jump if Overflow (OF=1)
		case NN_jp:                  // Jump if Parity (PF=1)
		case NN_jpe:                 // Jump if Parity Even (PF=1)
		case NN_jpo:                 // Jump if Parity Odd  (PF=0)
		case NN_js:                  // Jump if Sign (SF=1)
			return this->BuildJumpRTL(SMP_BINARY_NUMERIC_OPERATION);

		case NN_jz:                  // Jump if Zero (ZF=1)
			return this->BuildJumpRTL(SMP_EQUAL);

		case NN_jmp:                 // Jump
		case NN_jmpfi:               // Indirect Far Jump
		case NN_jmpni:               // Indirect Near Jump
		case NN_jmpshort:            // Jump Short (not used)
			return this->BuildJumpRTL(SMP_NULL_OPERATOR);

		case NN_lahf:                // Load Flags into AH Register
			return this->BuildMoveRTL(SMP_NULL_OPERATOR);

		case NN_lar:                 // Load Access Right Byte
			return false;
			break;

		case NN_lea:                 // Load Effective Address
			return this->BuildLeaRTL();

		case NN_leavew:              // High Level Procedure Exit
		case NN_leave:               // High Level Procedure Exit
		case NN_leaved:              // High Level Procedure Exit
		case NN_leaveq:              // High Level Procedure Exit
			return this->BuildLeaveRTL();

		case NN_lgdt:                // Load Global Descriptor Table Register
		case NN_lidt:                // Load Interrupt Descriptor Table Register
		case NN_lgs:                 // Load Full Pointer to GS:xx
		case NN_lss:                 // Load Full Pointer to SS:xx
		case NN_lds:                 // Load Full Pointer to DS:xx
		case NN_les:                 // Load Full Pointer to ES:xx
		case NN_lfs:                 // Load Full Pointer to FS:xx
		case NN_lldt:                // Load Local Descriptor Table Register
		case NN_lmsw:                // Load Machine Status Word
		case NN_lock:                // Assert LOCK# Signal Prefix
		case NN_lods:                // Load String
			return false;
			break;

		case NN_loopw:               // Loop while ECX != 0
		case NN_loop:                // Loop while CX != 0
		case NN_loopd:               // Loop while ECX != 0
		case NN_loopq:               // Loop while RCX != 0
		case NN_loopwe:              // Loop while CX != 0 and ZF=1
		case NN_loope:               // Loop while rCX != 0 and ZF=1
		case NN_loopde:              // Loop while ECX != 0 and ZF=1
		case NN_loopqe:              // Loop while RCX != 0 and ZF=1
		case NN_loopwne:             // Loop while CX != 0 and ZF=0
		case NN_loopne:              // Loop while rCX != 0 and ZF=0
		case NN_loopdne:             // Loop while ECX != 0 and ZF=0
		case NN_loopqne:             // Loop while RCX != 0 and ZF=0
			return false;
			break;

		case NN_lsl:                 // Load Segment Limit
		case NN_ltr:                 // Load Task Register
			return false;
			break;

		case NN_mov:                 // Move Data
		case NN_movsp:               // Move to/from Special Registers
		case NN_movs:                // Move Byte(s) from String to String
			return this->BuildMoveRTL(SMP_NULL_OPERATOR);

		case NN_movsx:               // Move with Sign-Extend
			return this->BuildUnary2OpndRTL(SMP_SIGN_EXTEND);

		case NN_movzx:               // Move with Zero-Extend
			return this->BuildUnary2OpndRTL(SMP_ZERO_EXTEND);

		case NN_mul:                 // Unsigned Multiplication of AL or AX
			return this->BuildMultiplyDivideRTL(SMP_U_MULTIPLY);

		case NN_neg:                 // Two's Complement Negation
			return this->BuildUnaryRTL(SMP_NEGATE);

		case NN_nop:                 // No Operation
			NopRT = new SMPRegTransfer;
			NopRT->SetOperator(SMP_NULL_OPERATOR);
			this->RTL.push_back(NopRT);
			NopRT = NULL;
			return true;

		case NN_not:                 // One's Complement Negation
			return this->BuildUnaryRTL(SMP_BITWISE_NOT);

		case NN_or:                  // Logical Inclusive OR
			return this->BuildBinaryRTL(SMP_BITWISE_OR);

		case NN_out:                 // Output to Port
			return this->BuildBinaryRTL(SMP_OUTPUT);

		case NN_outs:                // Output Byte(s) to Port
			return false;
			break;

		case NN_pop:                 // Pop a word from the Stack
		case NN_popaw:               // Pop all General Registers
		case NN_popa:                // Pop all General Registers
		case NN_popad:               // Pop all General Registers (use32)
		case NN_popaq:               // Pop all General Registers (use64)
		case NN_popfw:               // Pop Stack into Flags Register
		case NN_popf:                // Pop Stack into Flags Register
		case NN_popfd:               // Pop Stack into Eflags Register
		case NN_popfq:               // Pop Stack into Rflags Register
			return this->BuildPopRTL();

		case NN_push:                // Push Operand onto the Stack
		case NN_pushaw:              // Push all General Registers
		case NN_pusha:               // Push all General Registers
		case NN_pushad:              // Push all General Registers (use32)