# ZeroOpFunc2 no input and returns a number .ZeroOpFunc2->rdtsc rdtscp lbr_save lbr_dump lbr_print lbr_restore lbr_check # OneOpFunc1 input is a number and returns a number. .OneOpFunc1->poi db dd dw dq neg hi low not check_address strlen wcslen disassemble_len disassemble_len32 disassemble_len64 interlocked_increment interlocked_decrement reference physical_to_virtual virtual_to_physical poi_pa hi_pa low_pa db_pa dd_pa dw_pa dq_pa lbr_restore_by_filter # TwoOpFunc1 inputs are two numbers and returns a number. .TwoOpFunc1->ed eb eq interlocked_exchange interlocked_exchange_add wcscmp eb_pa ed_pa eq_pa # ThreeOpFunc1 inputs are three numbers and returns a number. .ThreeOpFunc1->interlocked_compare_exchange # OneOpFunc3 input is a number or a string and returns a number. .OneOpFunc3->strlen # TwoOpFunc3 the two inputs are numbers or strings and returns a number. .TwoOpFunc3->strcmp # ThreeOpFunc3 the first two inputs are numbers or strings and the third input is a number and returns a number. .ThreeOpFunc3->memcmp strncmp # OneOpFunc4 input is a number or a wstring and returns a number. .OneOpFunc4->wcslen # TwoOpFunc4 the two inputs are numbers or wstrings and returns a number. .TwoOpFunc4->wcscmp # ThreeOpFunc4 the first two inputs are numbers or wstrings and the third input is a number and returns a number. .ThreeOpFunc4->wcsncmp .OperatorsOneOperand->inc dec reference dereference S->BE BE->B1 B1->B1 || B2 @OR B1->B2 B2->B2 && B3 @AND B2->B3 B3->B3 | B4 @OR B3->B4 B4->B4 ^ B5 @XOR B4->B5 B5->B5 & B6 @AND B5->B6 B6->CMP CMP->CMP > EXP @GT CMP->CMP < EXP @LT CMP->CMP >= EXP @EGT CMP->CMP <= EXP @ELT CMP->CMP == EXP @EQUAL CMP->CMP != EXP @NEQ CMP->EXP EXP->E3 E3->E3 >> E4 @ASR E3->E3 << E4 @ASL E3->E4 E4->E4 + E5 @ADD E4->E4 - E5 @SUB E4->E5 E5->E5 / E10 @DIV E5->E5 % E10 @MOD E5->E5 * E10 @MUL E5->E10 E10->E12 E10->- E12 @NEG E10->+ E12 E10->~ E12 @NOT E10->* E12 @POI E10->& E12 @REFERENCE E12->.ZeroOpFunc2 ( ) @.ZeroOpFunc2 E12->.OneOpFunc1 ( EXP ) @.OneOpFunc1 E12->.TwoOpFunc1 ( EXP , EXP ) @.TwoOpFunc2 E12->.ThreeOpFunc1 ( EXP , EXP , EXP ) @.ThreeOpFunc1 E12->.OneOpFunc3 ( StringNumber ) @.OneOpFunc3 E12->.TwoOpFunc3 ( StringNumber , StringNumber ) @.TwoOpFunc3 E12->.ThreeOpFunc3 ( StringNumber , StringNumber , EXP ) @.ThreeOpFunc3 E12->.OneOpFunc4 ( WstringNumber ) @.OneOpFunc4 E12->.TwoOpFunc4 ( WstringNumber , WstringNumber ) @.TwoOpFunc4 E12->.ThreeOpFunc4 ( WstringNumber , WstringNumber , EXP ) @.ThreeOpFunc4 E12->( BE ) # Types must have '_' at the first E12->_register @PUSH E12->_global_id @PUSH E12->_local_id @PUSH E12->_function_parameter_id @PUSH E12->ARRAY1 # numbers E12->_hex @PUSH E12->_decimal @PUSH E12->_octal @PUSH E12->_binary @PUSH E12->_pseudo_register @PUSH E12->E13 ( VA2 ) @END_OF_CALLING_USER_DEFINED_FUNCTION_WITH_RETURNING_VALUE E13->_function_id @PUSH VA2->eps VA2->EXP VA3 VA3->, EXP VA3 VA3->eps STRING->_string @PUSH WSTRING->_wstring @PUSH StringNumber->EXP StringNumber->STRING WstringNumber->EXP WstringNumber->WSTRING ARRAY1->ARRAY2 ARRAY3 ARRAY4 @ARRAY_INDEX_READ ARRAY2->_local_id @PUSH ARRAY3->[ EXP ] @ARRAY_DIM_NUMBER ARRAY4->ARRAY3 ARRAY4 ARRAY4->eps