/****************************  disasm1.cpp   ********************************
* Author:        Agner Fog
* Date created:  2007-02-25
* Last modified: 2016-11-09
* Project:       objconv
* Module:        disasm1.cpp
* Description:
* Module for disassembler.
*
* Most of the disassembler code is in this file.
* Instruction tables are in opcodes.cpp.
* All functions relating to file output are in disasm2.cpp
*
* Copyright 2007-2016 GNU General Public License http://www.gnu.org/licenses
*****************************************************************************/
#include "stdafx.h"


/**************************  class CSymbolTable   *****************************

class CSymbolTable is a container class for a sorted list of symbols. The list
of symbols is kept sorted by address at all times. Named symbols from the 
original file are added to the list with AddSymbol(). New symbols for jump 
targets and code blocks that do not have a name are added during pass 1 by
NewSymbol(). AssignNames() assigns names to these unnamed symbols.

A symbol in the list can be found in three different ways: By its address,
by its old index, and by its new index. The new index is monotonous, so that
consecutive new indices correspond to consecutive addresses. Unfortunately,
the new index of a symbol will change whenever another symbol with a lower 
address is added to the list. Therefore, we need to use the old index rather
than the new index for identifying a symbol, e.g. in the relocation table.
The old index is a permanent, unique identifier, but in random order.
The old index of a symbol is usually the same as the index used in the
original file and in the relocation table. New symbols added during pass 1
will get assigned an old index which is higher than the highest value that
occurred in the original file. Do not make a pointer or reference to a symbol.
It may become invalid when new symbols are added.

To access a symbol by its old index, you have to translate it with Old2NewIndex
To access a symbol by its new index, use operator [].
To find a symbol by its address, use FindByAddress().

******************************************************************************/

CSymbolTable::CSymbolTable() {
    // Constructor
    OldNum = 1;
    NewNum = 0;                                   // Initialize
    UnnamedNum = 0;                               // Number of unnamed symbols
    UnnamedSymFormat = 0;                         // Format string for giving names to unnamed symbols
    UnnamedSymbolsPrefix = cmd.SubType == SUBTYPE_GASM ? "$_" : "?_";// Prefix to add to unnamed symbols
    ImportTablePrefix = "imp_";                   // Prefix for pointers in import table

    // Make dummy symbol number 0
    SASymbol sym0;
    sym0.Reset();
    sym0.Section = 0x80000000;                    // Lowest possible address
    List.PushSort(sym0);                          // Put into Symbols list

    SymbolNameBuffer.Push(0, 1);                  // Make string 0 empty
}

uint32 CSymbolTable::AddSymbol(int32 Section, uint32 Offset, uint32 Size, 
uint32 Type, uint32 Scope, uint32 OldIndex, const char * Name, const char * DLLName) {
    // Add symbol from original file to symbol table.
    // If name is not known then set Name = 0. A name will then be assigned
    // OldIndex is the identifier used in relocation records. If the symbol is known
    // by address rather than by index, then set OldIndex = 0. The return value will
    // be the assigned value of OldIndex to use in relocation records. The returned value 
    // of OldIndex will be equal to the OldIndex of any previous symbols with same address.

    // Symbol record
    SASymbol NewSym;                              // New symbol table entry

    NewSym.Section  = Section;
    NewSym.Offset   = Offset;
    NewSym.Size     = Size;
    NewSym.Type     = Type;
    NewSym.Scope    = Scope;
    NewSym.OldIndex = OldIndex;

    // Store symbol name in NameBuffer
    if (Name && *Name) {
        NewSym.Name = SymbolNameBuffer.GetDataSize();
        if (DLLName) {
            // Imported from DLL. Prefix name with "imp_"
            SymbolNameBuffer.Push(ImportTablePrefix, (uint32)strlen(ImportTablePrefix));
        }
        // Store name
        SymbolNameBuffer.PushString(Name);
    }
    else {
        NewSym.Name = 0;                           // Will get a name later
    }
    // Store DLL name in NameBuffer
    if (DLLName && *DLLName) {
        NewSym.DLLName = SymbolNameBuffer.PushString(DLLName);
    }
    else {
        NewSym.DLLName = 0;
    }

    if (OldIndex == 0) {
        // Make non-unique entry
        uint32 NewIndex = NewSymbol(NewSym);
        // Get old index
        OldIndex = List[NewIndex].OldIndex;
    }
    else {
        // Make unique entry
        List.PushSort(NewSym);
    }

    // Set OldNum to 1 + maximum OldIndex
    if (OldIndex >= OldNum) OldNum = OldIndex + 1;

    return OldIndex;
}

uint32 CSymbolTable::NewSymbol(SASymbol & sym) {
    // Add symbol to symbol table.
    // Will not add a new symbol if one already exists at this address and
    // either the new symbol or the existing symbol has no name.
    // The return value is the new index to a new or existing symbol.
    // The type or scope of any existing symbol will be modified if
    // the type or scope of the new symbol is higher.
    // The name will be applied to the existing symbol if the existing symbol 
    // has no name.

    // Find new index of any existing symbol with same address
    int32 SIndex = FindByAddress(sym.Section, sym.Offset);

    if (SIndex > 0 && !(List[SIndex].Type & 0x80000000)
        && !(sym.Name && List[SIndex].Name)) {
            // Existing symbol found. Update it with type and scope

            // Choose between Type of existing symbol and new Type information.
            // The highest Type value takes precedence, except near indirect jump/call,
            // which has highest precedence
            if (((sym.Type & 0xFF) > (List[SIndex].Type & 0xFF)
                && ((List[SIndex].Type+1) & 0xFE) != 0x0C) || ((sym.Type+1) & 0xFE) == 0x0C) {
                    // New symbol has higher type
                    List[SIndex].Type = sym.Type;
            }
            if ((sym.Scope & 0xFF) > (List[SIndex].Scope & 0xFF)) {
                // New symbol has higher Scope
                List[SIndex].Scope = sym.Scope;
            }
            if (sym.Name && !List[SIndex].Name) {
                // New symbol has name, old symbol has no name
                List[SIndex].Name = sym.Name;
            }
    }
    else {
        // No existing symbol. Make new one
        // Give it an old index
        if (sym.OldIndex == 0) sym.OldIndex = OldNum++;

        SIndex = List.PushSort(sym);
    }

    // Return new index
    return SIndex;
}


uint32 CSymbolTable::NewSymbol(int32 Section, uint32 Offset, uint32 Scope) {
    // Add symbol to jump target or code block that doesn't have a name.
    // Will not add a new symbol if one already exists at this address.
    // The return value is the new index to a new or existing symbol.
    // The symbol will get a name later.

    // Symbol record
    SASymbol NewSym;                              // New symbol table entry
    NewSym.Reset();

    NewSym.Section  = Section;
    NewSym.Offset   = Offset;
    NewSym.Scope    = Scope;

    // Store new symbol record if no symbol with this address already exists
    return NewSymbol(NewSym);
}

void CSymbolTable::AssignNames() {
    // Assign names to symbols that do not have a name

    uint32 i;                                     // New symbol index
    uint32 NumDigits;                             // Number of digits in new symbol names
    char name[64];                                // Buffer for making symbol name
    static char Format[64];

    // Find necessary number of digits
    NumDigits = 3; i = NewNum;
    while (i >= 1000) {
        i /= 10;
        NumDigits++;
    }

    // Format string for symbol names
    sprintf(Format, "%s%c0%i%c", UnnamedSymbolsPrefix, '%', NumDigits, 'i');
    UnnamedSymFormat = Format;

    // Update TranslateOldIndex
    UpdateIndex();

    // Loop through symbols
    for (i = 1; i < List.GetNumEntries(); i++) {
        if (List[i].Name == 0 && List[i].Scope != 0) {
            // Symbol has no name. Make one
            sprintf(name, UnnamedSymFormat, ++UnnamedNum);
            // Store new name
            List[i].Name = SymbolNameBuffer.PushString(name);
        }
    }
    // Round up the value of UnnamedNum in case more names are assigned later
    if (NewNum < 1000) {
        UnnamedNum = (UnnamedNum + 199) / 100 * 100;
    }
    else {
        UnnamedNum = (UnnamedNum + 1999) / 1000 * 1000;
    }

#if 0 //
    // For debugging: list all symbols
    printf("\n\nSymbols:");
    for (i = 0; i < List.GetNumEntries(); i++) {

        //   if (List[i].Offset > 0x0 && List[i].Offset < 0x8)

        printf("\n%3X %3X %s Sect %i Offset %X Type %X Size %i Scope %i", 
            i, List[i].OldIndex, GetName(i), 
            List[i].Section, List[i].Offset, List[i].Type, List[i].Size, List[i].Scope);
    }
#endif
}

uint32 CSymbolTable::FindByAddress(int32 Section, uint32 Offset, uint32 * Last, uint32 * NextAfter) {
    // Find symbols by address
    // The return value will be the new index to the first symbol at the 
    // specified address. The return value will be zero if no symbol found.
    // If more than one symbol is found with the same address then Last
    // will receive the new index of the last symbol with this address.
    // NextAfter will receive the new index of the first symbol with an
    // address higher than the specified address in the same section, or 
    // zero if none.

    uint32 i1;                                    // New index of first symbol
    uint32 i2;                                    // New index of last symbol
    uint32 i3;                                    // New index of first symbol after address

    // Make dummy symbol record for searching
    SASymbol sym;
    sym.Section = Section;
    sym.Offset  = Offset;

    // Search List by address
    i1 = List.FindFirst(sym);

    if (i1 == 0 || i1 >= List.GetNumEntries()) {
        // No symbol found at this address or later. Return 0
        if (NextAfter) *NextAfter = 0;
        return 0;
    }
    if (sym < List[i1]) {
        // No symbol found at this address, but one found at higher address
        // Check if same section
        if (List[i1].Section != Section) i1 = 0;
        // Return symbol at later address
        if (NextAfter) *NextAfter = i1;
        return 0;
    }

    // A symbol was found at this address.
    // Search for more symbols at same address
    i2 = i1;
    while (i2+1 < List.GetNumEntries() && !(sym < List[i2+1])) i2++;

    // Search for first symbol after this address in same section
    if (i2+1 < List.GetNumEntries() && List[i2+1].Section == Section) {
        i3 = i2 + 1;                               // Found
    }
    else {
        i3 = 0;                                    // Not found
    }

    // Return last symbol at same address
    if (Last) *Last = i2;

    // Return first symbol at higher address
    if (NextAfter) *NextAfter = i3;

    // Return first symbol at address
    return i1;
}

uint32 CSymbolTable::FindByAddress(int32 Section, uint32 Offset) {
    // Find symbols by address
    // The return value will be the new index to a first symbol at the 
    // specified address. If more than one symbol is found at the same
    // address then the one with the highest scope (and which is not
    // a section record) is returned;
    uint32 s0, s1, s2 = 0;
    uint32 MaxScope = 0;
    // Find all symbols at this address
    s0 = s1 = FindByAddress(Section, Offset, &s2);
    // Check if any symbols found
    if (s0 == 0) return 0;

    // Loop through symbols at this address
    for (; s1 <= s2; s1++) {
        // Look for highest scope (and not section)
        if ((*this)[s1].Scope >= MaxScope && !((*this)[s1].Type & 0x80000000)) {
            s0 = s1;  MaxScope = (*this)[s1].Scope;
        }
    }
    // Return index to symbol with highest scope
    return s0;
}

uint32 CSymbolTable::Old2NewIndex(uint32 OldIndex) {
    // Translate old symbol index to new symbol index

    // Check if TranslateOldIndex is up to date
    if (NewNum != List.GetNumEntries()) {
        // New entries have been added since last update. Update TranslateOldIndex
        UpdateIndex();
    }
    // Check if valid
    if (OldIndex >= OldNum) OldIndex = 0;

    // Translate old index to new index
    uint32 NewIndex = TranslateOldIndex[OldIndex];

    // Check limit
    if (NewIndex >= NewNum) NewIndex = 0;

    // Return new index
    return NewIndex;
}

const char * CSymbolTable::HasName(uint32 symo) {
    // Ask if symbol has a name, input = old index, output = name or 0
    // Returns 0 if symbol has no name yet.
    // Use HasName rather than GetName or GetNameO during pass 1 to avoid
    // naming symbols in random order.

    // Get new index
    uint32 symi = Old2NewIndex(symo);
    // Check if valid
    if (symi == 0 || symi >= NewNum) return 0;
    // Check if symbol has a name
    if ((*this)[symi].Name == 0) return 0;
    // Symbol has a name
    return GetName(symi);
}

const char * CSymbolTable::GetName(uint32 symi) {
    // Get symbol name from new index.
    // A name will be assigned to the symbol if it doesn't have one

    // Get name index from symbol record
    uint32 NameIndex = (*this)[symi].Name;
    if (NameIndex == 0) {
        // Symbol has no name
        // Search for other symbol with same address
        uint32 Alias = FindByAddress((*this)[symi].Section,(*this)[symi].Offset);
        if ((*this)[Alias].Name) {
            // A named symbol with same address found
            NameIndex = (*this)[Alias].Name;
        }
        else {
            // Give symbol a name
            // This should occur only if new symbols are made during pass 2
            char name[64];                             // Buffer for making symbol name
            sprintf(name, "Unnamed_%X_%X", (*this)[symi].Section, (*this)[symi].Offset);
            // sprintf(name, UnnamedSymFormat, ++UnnamedNum);
            // Store new name
            NameIndex = (*this)[symi].Name = SymbolNameBuffer.PushString(name);         
        }
    }
    // Check if valid
    if (NameIndex == 0 || NameIndex >= SymbolNameBuffer.GetDataSize()) {
        // NameIndex is invalid
        return "ErrorNoName";
    }
    // Return name
    return SymbolNameBuffer.Buf() + NameIndex;
}

const char * CSymbolTable::GetNameO(uint32 symo) {
    // Get symbol name by old index.
    // A name will be assigned to the symbol if it doesn't have one
    return GetName(Old2NewIndex(symo));
}

const char * CSymbolTable::GetDLLName(uint32 symi) {
    // Get import DLL name from old index
    if ((*this)[symi].DLLName == 0) {
        // No name
        return "ErrorNoName";
    }
    // Get name DLL index from symbol record
    uint32 NameIndex = (*this)[symi].DLLName;
    // Check if valid
    if (NameIndex == 0 || NameIndex >= SymbolNameBuffer.GetDataSize()) {
        // NameIndex is invalid
        return "ErrorNoName";
    }
    // Return name
    return SymbolNameBuffer.Buf() + NameIndex;
}

void CSymbolTable::AssignName(uint32 symi, const char *name) {
    // Give symbol a specific name
    (*this)[symi].Name = SymbolNameBuffer.PushString(name);
}

void CSymbolTable::UpdateIndex() {
    // Update TranslateOldIndex
    uint32 i;                                     // New index

    // Allocate array with sufficient size
    TranslateOldIndex.SetNum(OldNum);

    // Initialize to zeroes
    memset(&TranslateOldIndex[0], 0, TranslateOldIndex.GetNumEntries() * sizeof(uint32));

    for (i = 0; i < List.GetNumEntries(); i++) {
        if (List[i].OldIndex < OldNum) {
            TranslateOldIndex[List[i].OldIndex] = i;
        }
        else {
            // symbol index out of range
            err.submit(2031);                       // Report error
            List[i].OldIndex = 0;                   // Reset index that was out of range
        }
    }
    NewNum = List.GetNumEntries();
}


/**************************  class CDisassembler  *****************************
Members of class CDisassembler
Members that relate to file output are in disasm2.cpp
******************************************************************************/

CDisassembler::CDisassembler() {
    // Constructor
    Sections.PushZero();                          // Make first section entry zero
    Relocations.PushZero();                       // Make first relocation entry zero
    NameBuffer.Push(0, 1);                        // Make first string entry zero   
    FunctionList.PushZero();                      // Make first function entry zero
    // Initialize variables
    Buffer = 0;
    InstructionSetMax = InstructionSetAMDMAX = 0;
    InstructionSetOR = FlagPrevious = NamesChanged = 0;
    WordSize = MasmOptions = RelocationsInSource = ExeType = 0;
    ImageBase = 0;
    Syntax = cmd.SubType;                         // Assembly syntax dialect
    if (Syntax == SUBTYPE_GASM) {
        CommentSeparator = "# ";                   // Symbol for indicating comment
        HereOperator = ".";                        // Symbol for current address
    }
    else {
        CommentSeparator = "; ";                   // Symbol for indicating comment
        HereOperator = "$";                        // Symbol for current address
    }
};

void CDisassembler::Init(uint32 ExeType, int64 ImageBase) {
    // Define file type and imagebase if executable file
    this->ExeType = ExeType;
    this->ImageBase = ImageBase;
}

void CDisassembler::AddSection(
uint8 * Buffer,                               // Buffer containing raw data
uint32  InitSize,                             // Size of initialized data in section
uint32  TotalSize,                            // Size of initialized and uninitialized data in section
uint32  SectionAddress,                       // Start address to be added to offset in listing
uint32  Type,                                 // 0 = unknown, 1 = code, 2 = data, 3 = uninitialized data, 4 = constant data
uint32  Align,                                // Alignment = 1 << Align
uint32  WordSize,                             // Segment word size: 16, 32 or 64
const char * Name,                            // Name of section
uint32  NameLength) {                         // Length of name if not zero terminated

    // Check values
    if (Buffer == 0) Type = 3;
    if (Name == 0) Name = "?";
    if (NameLength == 0) NameLength = (uint32)strlen(Name);
    if (TotalSize < InitSize) TotalSize = InitSize;

    // Define section to be disassembled
    SASection SecRec;                             // New section record

    SecRec.Start = Buffer;
    SecRec.SectionAddress = SectionAddress;
    SecRec.InitSize = InitSize;
    SecRec.TotalSize = TotalSize;
    SecRec.Type = Type;
    SecRec.Align = Align;
    SecRec.WordSize = WordSize;
    // Save name in NameBuffer
    SecRec.Name = NameBuffer.Push(Name, NameLength);
    // Terminate with zero
    NameBuffer.Push(0, 1);
    // Default group is 'flat' except in 16 bit mode
    if (WordSize == 16 || (MasmOptions & 0x100)) {
        // 16-bit or mixed segment size. Group is unknown
        SecRec.Group = 0;
    }
    else {
        // Pure 32 or 64 bit mode. Group = flat
        SecRec.Group = ASM_SEGMENT_FLAT;
    }

    // Save section record
    Sections.Push(SecRec);

    // Remember WordSize
    switch (WordSize) {
    case 16:
        MasmOptions |= 0x100;  break;
    case 32:
        MasmOptions |= 0x200;  break;
    case 64:
        MasmOptions |= 0x400;  break;
    }
}

int32 CDisassembler::AddSectionGroup(const char * Name, int32 MemberSegment) {
    // Define section group (from OMF file).
    // Must be called after all segments have been defined.
    // To define a group with multiple members, you must call AddSectionGroup
    // multiple times. You must finish adding members to one group before 
    // starting the definition of another group.
    // You can define a group without defining its members by calling 
    // AddSectionGroup with MemberSegment = 0.

    // Check values
    if (Name == 0) Name = "?";

    // Find preceding segment or group definition
    int32 LastIndex = Sections.GetNumEntries() - 1;
    // Index of group record
    int32 GroupIndex = LastIndex;

    const char * LastName = "?";
    if (Sections[LastIndex].Name < NameBuffer.GetDataSize()) {
        // Last name valid
        LastName = NameBuffer.Buf() + Sections[LastIndex].Name;
    }
    // Check if group name already defined
    if (strcmp(Name, LastName) != 0) {
        // Not define. Make group record in Sections list
        SASection SecRec;                             // New section record
        memset(&SecRec, 0, sizeof(SecRec));           // Initialize

        // Set type = group
        SecRec.Type = 0x800;

        // Save name in NameBuffer
        SecRec.Name = NameBuffer.PushString(Name);

        // Save group index = my own index
        SecRec.Group = ++GroupIndex;

        // Save section record
        Sections.Push(SecRec);
    }
    // Find MemberSegment record
    if (MemberSegment && MemberSegment < GroupIndex) {
        // Register group index in segment record
        Sections[MemberSegment].Group = GroupIndex;
    }
    // Return value is group index
    return GroupIndex;
}

uint32 CDisassembler::AddSymbol(
int32  Section,                            // Section number (1-based). ASM_SEGMENT_UNKNOWN = external, ASM_SEGMENT_ABSOLUTE = absolute, ASM_SEGMENT_IMGREL = image-relative
uint32 Offset,                             // Offset into section. (Value for absolute symbol)
uint32 Size,                               // Number of bytes used by symbol or function. 0 = unknown
uint32 Type,                               // Symbol type. Use values listed above for SOpcodeDef operands. 0 = unknown type
uint32 Scope,                              // 1 = function local, 2 = file local, 4 = public, 8 = weak public, 0x10 = communal, 0x20 = external
uint32 OldIndex,                           // Unique identifier used in relocation entries. Value must be > 0 and limited because an array is created with this as index.
const char * Name,                         // Name of symbol. Zero-terminated
const char * DLLName) {                    // Name of DLL if imported dynamically

    // Add symbol form original file.
    // Multiple symbols at same address are allowed.
    // If section is not known then set Section = ASM_SEGMENT_IMGREL and Offset = image-relative address
    // If name is not known then set Name = 0. A name will then be assigned
    // OldIndex is the identifier used in relocation records. It must be nonzero.
    // If the original file uses 0-based symbol indices then add 1 to OldIndex
    // and remember to also add 1 when referring to the symbol in a relocation record.
    // If the symbol is known by address rather than by index, then set OldIndex = 0. 
    // The return value will be the assigned value of OldIndex to use in relocation records.
    // The returned value of OldIndex will be equal to the OldIndex of any previous symbols 
    // with same address. All symbols that have an identifier (OldIndex) must be defined
    // before any symbol identified by address only in order to avoid using the same OldIndex.

    // Check if image-relative
    if (Section == ASM_SEGMENT_IMGREL) {   
        // Translate absolute virtual address to section and offset
        TranslateAbsAddress(ImageBase + (int32)Offset, Section, Offset);
    }

    // Define symbol for disassembler
    return Symbols.AddSymbol(Section, Offset, Size, Type, Scope, OldIndex, Name, DLLName);
}

void CDisassembler::AddRelocation(
int32  Section,                               // Section of relocation source
uint32 Offset,                                // Offset of relocation source into section
int32  Addend,                                // Addend to add to target address, 
// including distance from source to instruction pointer in self-relative addresses,
// not including inline addend.
uint32 Type,                                  // Relocation type. See SARelocation in disasm.h for definition of values
uint32 Size,                                  // 1 = byte, 2 = word, 4 = dword, 8 = qword
uint32 TargetIndex,                           // Symbol index of target
uint32 ReferenceIndex) {                      // Symbol index of reference point if Type = 8 or 0x10

    // Check if image-relative
    if (Section == ASM_SEGMENT_IMGREL) {   
        // Translate absolute virtual address to section and offset
        if (!TranslateAbsAddress(ImageBase + (int32)Offset, Section, Offset)) {
            err.submit(1304);
        }
    }

    if (Type != 0x41) {
        // Define relocation or cross-reference for disassembler
        SARelocation RelRec;                          // New relocation record

        RelRec.Section = Section;
        RelRec.Offset = Offset;
        RelRec.Type = Type;
        RelRec.Size = Size;
        RelRec.Addend = Addend;
        RelRec.TargetOldIndex = TargetIndex;
        RelRec.RefOldIndex = ReferenceIndex;

        // Save relocation record
        Relocations.PushSort(RelRec);
    }
    else {
        // Make entry in procedure linkage table
        uint32 targetsym = Symbols.Old2NewIndex(TargetIndex);
        if (targetsym && Symbols[targetsym].DLLName) {
            // Put label on entry in procedure linkage table (import table)
            // Copy Name and DLLName from target symbol
            SASymbol ImportSym = Symbols[targetsym];
            ImportSym.Section = Section;
            ImportSym.Offset = Offset;
            ImportSym.Type = 0x0C;
            ImportSym.OldIndex = 0;
            ImportSym.Scope = 2;
            Symbols.NewSymbol(ImportSym);
        }
    }
}

void CDisassembler::Go() {
    // Do the disassembly

    // Check for illegal entries in relocations table
    InitialErrorCheck();

    // Find missing relocation target addresses
    FixRelocationTargetAddresses();

    // Pass 1: Find symbols types and unnamed symbols
    Pass = 1;
    Pass1();
    Pass = 2;
    Pass1(); 

    if (Pass & 0x100) {
        // Repetition of pass 1 requested
        Pass = 3;
        Pass1();
        Pass = 4;
        Pass1();
    }

    // Put names on unnamed symbols
    Symbols.AssignNames();

    // Fix invalid characters in symbol and section names
    CheckNamesValid();

#if 0 //
    // Show function list. For debugging only
    printf("\n\nFunctionList:");
    for (uint32 i = 0; i < FunctionList.GetNumEntries(); i++) {
        printf("\nsect %i, start %X, end %X, scope %i, name %s",
            FunctionList[i].Section, FunctionList[i].Start, FunctionList[i].End, 
            FunctionList[i].Scope, Symbols.GetNameO(FunctionList[i].OldSymbolIndex));
    }
#endif
#if 0 
    // For debugging: list all relocations
    printf("\n\nRelocations:");
    for (uint32 i = 0; i < Relocations.GetNumEntries(); i++) {
        printf("\nsect %i, os %X, type %X, size %i, add %X, target %X",
            Relocations[i].Section, Relocations[i].Offset, Relocations[i].Type, 
            Relocations[i].Size, Relocations[i].Addend, Relocations[i].TargetOldIndex);
    }
#endif
#if 0
    // For debugging: list all sections
    printf("\n\nSections:");
    for (uint32 s = 1; s < Sections.GetNumEntries(); s++) {
        printf("\n%2i, %s", s, NameBuffer.Buf() + Sections[s].Name);
    }
#endif

    // Begin writing output file
    WriteFileBegin();

    // Pass 2: Write all sections to output file
    Pass = 0x10;
    Pass2();

    // Check for illegal entries in symbol table and relocations table
    FinalErrorCheck();

    // Finish writing output file
    WriteFileEnd();
};

void CDisassembler::Pass1() {

    /*             Pass 1: does the following jobs:
    --------------------------------

    * Scans all code sections, instruction by instruction. Checks code syntax.

    * Tries to identify where each function begins and ends.

    * Follows all references to data in order to determine data type for 
    each data symbol.

    * Assigns symbol table entries for all jump and call targets that do not
    allready have a name.

    * Follows all jump instructions to identify code blocks that are connected.
    Code blocks in same section that are connected through jumps (not calls)
    are joined together into the same function.

    * Identifies and analyzes tables of jump addresses and call addresses,
    e.g. switch/case tables and virtual function tables.

    * Tries to identify any data in the code section. If erroneous code or
    sequences of zeroes are found then the nearest preceding label is marked
    as dubious and the analysis of code is skipped until the next code label.
    Pass 1 will be repeated in this case in order to follow backwards jumps
    from subsequent code. Dubious code will be shown as both code and data 
    in the output of pass 2.
    */

    // Loop through sections, pass 1
    for (Section = 1; Section < Sections.GetNumEntries(); Section++) {

        // Get section type
        SectionType = Sections[Section].Type;
        if (SectionType & 0x800) continue;         // This is a group

        // Code or data
        CodeMode = (SectionType & 1) ? 1 : 4;
        LabelBegin = FlagPrevious = CountErrors = 0;

        if ((Sections[Section].Type & 0xFF) == 1) {
            // This is a code section

            // Initialize code parser
            Buffer     = Sections[Section].Start;
            SectionEnd = FunctionEnd = LabelInaccessible = Sections[Section].TotalSize;
            WordSize   = Sections[Section].WordSize;
            SectionAddress = Sections[Section].SectionAddress;
            if (Buffer == 0) continue;

            IBegin = IEnd = LabelEnd = 0;
            IFunction = 0;

            // Loop through instructions
            while (NextInstruction1()) {

                // check if function beings here
                CheckForFunctionBegin();

                // Find any label here
                FindLabels();

                // Check if code
                if (CodeMode < 4) {
                    // This is code

                    // Parse instruction
                    ParseInstruction();
                }
                else {
                    // This is data. Skip to next label
                    IEnd = LabelEnd;
                }
                // check if function ends here
                CheckForFunctionEnd();
            }
        }
        else {
            // This is a data section
            // Make a single entry in FunctionList covering the whole section
            SFunctionRecord fun = {(int)Section, 0, Sections[Section].TotalSize, 0, 0};
            FunctionList.PushUnique(fun);
        }
    }
}

void CDisassembler::FindLabels() {
    // Find any labels at current position and next during pass 1
    uint32 sym1, sym2 = 0, sym3 = 0;              // Symbol indices

    // Search for labels from IBegin
    sym1 = Symbols.FindByAddress(Section, IBegin, &sym2, &sym3);

    if (sym1 && sym2) {
        // Set LabelBegin to address of last label at current address
        LabelBegin = Symbols[sym2].Offset;
        CountErrors = 0;

        // Get code mode from label
        if ((Symbols[sym2].Type & 0xF0) == 0x80) {
            // This is known to be code
            CodeMode = 1;
        }
        else if ((Symbols[sym2].Type & 0xFF) == 0) {
            // Type is unknown
            if ((Symbols[sym2].Scope & 4) && SectionType == 1) {
                // Public label in code segment. Consider this code
                CodeMode = 1;
            } 
            // Otherwise: Assume same type as previous
        }
        else {
            // This is known to be data
            CodeMode = 4;
        }
        // Reset tracer
        t.Reset();
    }
    if (sym3) {
        // Set LabelEnd to address of next symbol
        LabelEnd = Symbols[sym3].Offset;
        if (LabelEnd > SectionEnd) LabelEnd = SectionEnd;
    }
    else {
        // No next label
        LabelEnd = SectionEnd;
    }
}

void CDisassembler::CheckForMisplacedLabel() {
    // Remove any label placed inside function
    // This is called if there appears to be a function end inside an instruction
    if (FunctionEnd && FunctionEnd < SectionEnd) {
        FunctionEnd = IEnd;
        FunctionList[IFunction].Scope |= 0x10000;
    }
    else {
        s.Errors |= 0x10;
    }
}

int CDisassembler::NextLabel() {
    // Loop through labels from IEnd. Pass 2
    uint32 sym, sym1, sym2 = 0, sym3 = 0;         // Symbol indices

    // Make ready for next instruction
    IBegin = IEnd;

    // Reset tracer
    t.Reset();

    // Check if end of function/section
    if (IEnd >= FunctionEnd || IEnd >= SectionEnd) {
        // No more labels in this function or section
        return 0;
    }

    // Search for labels from IEnd
    sym1 = Symbols.FindByAddress(Section, IEnd, &sym2, &sym3);

    if (sym1) {
        // Symbol found
        for (sym = sym1; sym <= sym2; sym++) {
            // Remember symbol address
            LabelBegin = Symbols[sym].Offset;
            CountErrors = 0;

            if ((SectionType & 0xFF) == 1) {
                // Code section. Get CodeMode
                if ((Symbols[sym].Type >> 24) & 0xF) {
                    // Get CodeMode from last label. 1 = code, 2 = dubiuos, 4 = data
                    CodeMode = (Symbols[sym].Type >> 24) & 0xF;
                }
                else if (Symbols[sym].Type & 0x80) {
                    // Type defined as jump/call. This is known to be code
                    CodeMode = 1;
                }
                else if (Symbols[sym].Type == 0) {
                    // Type is unknown. (Assume same type as previous) changed to:
                    // Type is unknown. Assume code
                    CodeMode = 1;
                }
                else {
                    // This has been accessed as data
                    CodeMode = 4;
                }
            }
            else {
                // This is a data segment
                CodeMode = 4;
            }
            // Get symbol type and size, except for section type
            if (!(Symbols[sym].Type & 0x80000000)) {
                DataType = Symbols[sym].Type;
                DataSize = GetDataItemSize(DataType);
                if (((DataType+1) & 0xFE) == 0x0C && Symbols[sym].Size) {
                    // Jump table can have different sizes for direct or image relative
                    DataSize = Symbols[sym].Size;
                }
            }
        }
    }
    if (sym3) {
        // Next label found
        LabelEnd = Symbols[sym3].Offset;
        return 1;
    }
    // No new label found. Continue to FunctionEnd
    LabelEnd = FunctionEnd;
    return 1;
}

int CDisassembler::NextFunction2() {
    // Loop through function blocks in pass 2. Return 0 if finished

    SFunctionRecord Fun;                          // Dummy function record for search and compare

    if (IFunction == 0) {
        // Begin of section. Find first function block
        Fun.Section = Section;
        Fun.Start   = IBegin;
        IFunction   = FunctionList.FindFirst(Fun);
    }
    else {
        // Try next function block
        IFunction++;
    }
    // Check if IFunction is valid
    if (IFunction == 0 || IFunction >= FunctionList.GetNumEntries()) {
        // Not valid
        IFunction = 0;
        return 0;
    }
    // Check if IFunction is within current section
    Fun.Section = Section;
    Fun.Start   = SectionEnd;
    if (Fun < FunctionList[IFunction]) {
        // Past end of current section
        IFunction = 0;
        return 0;
    }
    // IFunction is within current section
    // End of function
    FunctionEnd = FunctionList[IFunction].End;

    // Check if function has a defined size
    if (FunctionEnd <= FunctionList[IFunction].Start) {
        // Size unknown. Continue until begin of next function
        if (IFunction+1 < FunctionList.GetNumEntries()
            && FunctionList[IFunction+1] < Fun
            && FunctionList[IFunction] < FunctionList[IFunction+1]) {
                FunctionEnd = FunctionList[IFunction+1].Start;
        }
        else {
            // No next function. Continue until end of section
            FunctionEnd = SectionEnd;
        }
    }

    // return IFunction for success
    return 1;
}

void CDisassembler::CheckForFunctionBegin() {
    // Check if function begins at current position
    uint32 sym1, sym2 = 0, sym3 = 0;              // Symbol indices
    SFunctionRecord fun;                          // New function record
    IBegin = IEnd;

    if (IFunction == 0) {
        // No function defined. Begin new function here

        // Search for nearest labels
        sym1 = Symbols.FindByAddress(Section, IEnd, &sym2, &sym3);

        if (sym1 == 0) {
            // There is no label here. Make one with Scope = 0
            sym1 = Symbols.NewSymbol(Section, IEnd, 0);
            // Update labels
            LabelBegin = LabelEnd = CountErrors = 0;
            FindLabels();
        }
        // Check that sym1 is valid
        if (sym1 == 0 || sym1 >= Symbols.GetNumEntries()) {
            err.submit(9000);  return;
        }

        // Make function record for FunctionList
        fun.Section        = Section;
        fun.Start          = IBegin;
        fun.End            = IBegin;
        fun.Scope          = Symbols[sym1].Scope;
        fun.OldSymbolIndex = Symbols[sym1].OldIndex;

        // Add to function list
        IFunction = FunctionList.PushUnique(fun);

        // End of function not known yet
        FunctionEnd = SectionEnd;  LabelEnd = 0;
    }
}

void CDisassembler::CheckForFunctionEnd() {
    // Check if function ends at current position
    if (IFunction >= FunctionList.GetNumEntries()) {
        // Should not occur
        err.submit(9000);  IFunction = 0;  return;
    }

    // Function ends if section ends here
    if (IEnd >= SectionEnd) {
        // Current function must end because section ends here
        FunctionList[IFunction].End = SectionEnd;
        FunctionList[IFunction].Scope &= ~0x10000;
        IFunction = 0;

        // Check if return instruction
        if (s.OpcodeDef && !(s.OpcodeDef->Options & 0x10) && (Pass & 0x10)) {
            // No return or unconditional jump. Write error message
            s.Errors |= 0x10000;
            WriteErrorsAndWarnings();
        }
        return;
    }

    // Function ends after ret or unconditional jump and preceding code had no 
    // jumps beyond this position:
    if (s.OpcodeDef && s.OpcodeDef->Options & 0x10) {
        // A return or unconditional jump instruction was found.
        FlagPrevious |= 2;

        // Mark this position as inaccessible if there is no reference to this place
        Symbols.NewSymbol(Section, IEnd, 0);
        // Update labels
        LabelBegin = LabelEnd = CountErrors = 0;
        FindLabels();

        if (IEnd >= FunctionList[IFunction].End) {
            // Indicate current function ends here
            FunctionList[IFunction].End = IEnd;
            FunctionList[IFunction].Scope &= ~0x10000;
            IFunction = 0;
            return;
        }
    }

    // Function ends at next label if preceding label is inaccessible and later end not known
    if (IFunction && FunctionList[IFunction].Scope == 0 && IEnd >= FunctionList[IFunction].End) {
        if (Symbols.FindByAddress(Section, IEnd)) {
            // Previous label was inaccessible. There is a new label here. Begin new function here
            IFunction = 0;
            return;
        }
    }

    // Function does not end here
    return;
}


void CDisassembler::CheckRelocationTarget(uint32 IRel, uint32 TargetType, uint32 TargetSize) {
    // Update relocation record and its target.
    // This function updates the symbol type and size of a relocation target.
    // If the relocation target is a section:offset address then a new
    // symbol record is made
    uint32 SymOldI;                               // Old index of target symbol
    uint32 SymNewI;                               // New index of target symbol
    int32  TargetSection;                         // Section of target symbol
    uint32 TargetOffset;                          // Offset of target symbol

    // Check if relocation valid
    if (!IRel || IRel >= Relocations.GetNumEntries() || !Relocations[IRel].TargetOldIndex
        || Relocations[IRel].Section <= 0 || uint32(Relocations[IRel].Section) >= Sections.GetNumEntries()) {
            return;
    }

    // Find target symbol
    SymOldI = Relocations[IRel].TargetOldIndex;

    // Look up in symbol table
    SymNewI = Symbols.Old2NewIndex(SymOldI);

    // Check if valid
    if (!Symbols[SymNewI].OldIndex) return;

    if (Symbols[SymNewI].Type & 0x80000000) {
        // Symbol is a section record. Relocation refers to a section-relative address
        // Make a new symbol for this data item. The symbol will get a name later

        // Get address of new symbol
        TargetSection = Symbols[SymNewI].Section;
        TargetOffset  = Symbols[SymNewI].Offset + Relocations[IRel].Addend;

        // Pointer to relocation source address
        uint8 * RelSource = Sections[Relocations[IRel].Section].Start + Relocations[IRel].Offset;

        // Inline Addend;
        int32 InlineA = 0;
        switch (Relocations[IRel].Size) {
        case 1:
            InlineA = *(int8*)RelSource;  break;
        case 2:
            InlineA = *(int16*)RelSource;  break;
        case 4:  case 8:
            InlineA = *(int32*)RelSource;  break;
        }
        // Add inline addend to target address
        TargetOffset += InlineA;

        if (Relocations[IRel].Type & 2) {
            // Address is self-relative
            if ((s.AddressFieldSize && (s.MFlags & 0x100)) || s.ImmediateFieldSize) {
                // Relative jump or rip-relative address
                TargetOffset += IEnd - s.AddressField;
                InlineA      += IEnd - s.AddressField;
            } 
            else {
                // Self-relative address in data segment or unknown
                // This may occur in position-independent code
                // We can't calculate the intended target
                // Make sure there is a symbol, but don't change existing symbol if there is one
                SymNewI = Symbols.NewSymbol(TargetSection, 0, 2);
                return;
            }
        }
        // Make new symbol in symbol table if none exists
        SymNewI = Symbols.NewSymbol(TargetSection, TargetOffset, 2);

        if (SymNewI) {
            // Get old index
            SymOldI = Symbols[SymNewI].OldIndex;

            // Change relocation record to point to new symbol
            Relocations[IRel].TargetOldIndex = SymOldI;

            // Compensate for inline addend and rip-relative address
            Relocations[IRel].Addend = -InlineA;
        }
    }

    // Check if symbol has a scope assigned
    if (Symbols[SymNewI].Scope == 0) Symbols[SymNewI].Scope = 2;

    // Choose between Symbols[SymNewI].Type and TargetType the one that has the highest priority
    if ((TargetType & 0xFF) > (Symbols[SymNewI].Type & 0xFF) 
        || (((TargetType+1) & 0xFE) == 0x0C && (Symbols[SymNewI].Type & 0xFF) > 0x0C)) {

            // No type assigned yet, or new type overrides old type
            Symbols[SymNewI].Type = TargetType;

            // Choose biggest size. Size for code pointer takes precedence
            if (TargetSize > Symbols[SymNewI].Size || ((TargetType+1) & 0xFE) == 0x0C) {
                Symbols[SymNewI].Size = TargetSize;
            }
    }
}


void CDisassembler::CheckJumpTarget(uint32 symi) {
    // Extend range of current function to jump target, if needed

    // Check if current section is valid
    if (Section == 0 || Section >= Sections.GetNumEntries()) return;

    // Check if current function is valid
    if (IFunction == 0 || IFunction >= FunctionList.GetNumEntries()) return;

    // Check if target is in same section
    if (Symbols[symi].Section != (int32)Section) return;

    // Check if target extends current function
    if (Symbols[symi].Offset > FunctionList[IFunction].End && Symbols[symi].Offset <= Sections[Section].InitSize) {
        // Target is after tentative end of current function but within section

        // Check if it is a known function
        if ((Symbols[symi].Type & 0xFF) == 0x83 || (Symbols[symi].Type & 0xFF) == 0x85
            || (Symbols[symi].Scope & 0x1C)) {
                // Target is known as public or a function. No need to extend current function
                return;
        }
        // Extend current function forward to include target offset
        FunctionList[IFunction].End = Symbols[symi].Offset;
        FunctionList[IFunction].Scope |= 0x10000;
    }
    else if (Symbols[symi].Offset < FunctionList[IFunction].Start) {
        // Target is before tentative begin of current function but within section

        // Check if target is already in function table
        SFunctionRecord fun;
        fun.Section = Symbols[symi].Section;
        fun.Start   = Symbols[symi].Offset;
        uint32 IFun = FunctionList.Exists(fun);
        if (IFun > 0 && IFun < FunctionList.GetNumEntries()) {
            // Target is the beginning of a known function. No need to extend current function
            return;
        }

        /* Removed: This is a mess. Looks better when functions are separate
        // Target points inside a previously defined function. Join the two functions into one
        IFun = FunctionList.FindFirst(fun) - 1;
        if (IFun > 0 && IFun < FunctionList.GetNumEntries() && FunctionList[IFun].Section == Section) {

        // Get maximum scope of the two functions
        if (FunctionList[IFun].Scope < FunctionList[IFunction].Scope) {
        FunctionList[IFun].Scope = FunctionList[IFunction].Scope;
        }

        // Get maximum end of the two functions
        if (FunctionList[IFun].End < FunctionList[IFunction].End) {
        FunctionList[IFun].End = FunctionList[IFunction].End;
        }         

        // Remove entry IFunction from FunctionList
        FunctionList.Remove(IFunction);

        // Set current function to IFun
        IFunction = IFun;
        }
        */
    }
}


void CDisassembler::Pass2() {

    /*             Pass 2: does the following jobs:
    --------------------------------

    * Scans through all sections, code and data.

    * Code is analyzed, instruction by instruction. Checks code syntax.

    * Outputs warnings for suboptimal instruction codes and error messages
    for erroneous code and erroneous relocations.

    * Outputs disassembly of all instructions, operands and relocations, 
    followed by the binary code listing as comment.

    * Outputs disassembly of all data, followed by alternative representations
    as comment.

    * Outputs dubious code as both code and data in order to allow a re-assembly
    to produce identical code.
    */

    // Loop through sections, pass 2
    for (Section = 1; Section < Sections.GetNumEntries(); Section++) {

        // Get section type
        SectionType = Sections[Section].Type;
        if (SectionType & 0x800) continue;         // This is a group

        if (((SectionType & 0xFF) == 0x10) && cmd.DebugInfo == CMDL_DEBUG_STRIP) {
            // Skip debug section
            cmd.CountDebugRemoved();
            continue;
        }
        if (((SectionType & 0xFF) == 0x11) && cmd.ExeptionInfo == CMDL_EXCEPTION_STRIP) {
            // Skip exception section
            cmd.CountExceptionRemoved();
            continue;
        }
        // Is this code or data?
        CodeMode = ((SectionType & 0xFF) == 1) ? 1 : 4;

        // Initialize
        LabelBegin = FlagPrevious = CountErrors = 0;
        Buffer = Sections[Section].Start;
        SectionEnd = Sections[Section].TotalSize;
        LabelInaccessible = Sections[Section].InitSize;
        WordSize = Sections[Section].WordSize;
        SectionAddress = Sections[Section].SectionAddress;

        // Write segment directive
        WriteSegmentBegin();

        IBegin = IEnd = LabelEnd = IFunction = DataType = DataSize = 0;

        // Loop through function blocks in this section
        while (NextFunction2()) {

            // Check CodeMode from label
            NextLabel();

            // Write begin function
            if (CodeMode & 3) WriteFunctionBegin();

            // Loop through labels
            while (NextLabel()) {

                // Loop through code
                while (NextInstruction2()) {

                    if (CodeMode & 3) {
                        // Interpret this as code

                        // Write label if any
                        CheckLabel();

                        // Parse instruction
                        ParseInstruction();

                        // Check for filling space
                        if (((s.Warnings1 & 0x10000000) || s.Warnings1 == 0x1000000) && WriteFillers()) {
                            // Code is inaccessible fillers. Has been written by CheckForFillers()
                            continue;
                        }

                        // Write any error and warning messages to OutFile
                        WriteErrorsAndWarnings();

                        // Write instruction to OutFile
                        WriteInstruction();

                        // Write hex code as comment after instruction
                        WriteCodeComment();
                    }
                    if (CodeMode & 6) {

                        // Interpret this as data
                        WriteDataItems();
                    }
                    if (IEnd <= IBegin) {

                        // Prevent infinite loop
                        IEnd++;
                        break;
                    }
                }
            }
            // Write end of function, if any
            if (CodeMode & 3) WriteFunctionEnd();         // End function
        }
        // Write end of segment
        WriteSegmentEnd();
    }
}

/********************  Explanation of tracer:  ***************************

This is a machine which can trace the contents of each register in certain
situations. It is currently used for recognizing certain instruction patterns
that are used by various 64 bit compilers for accessing jump tables and
virtual function tables. The trace machine can be extended for other purposes.

A switch/case statement is typically implemented as follows by the 64 bit MS
C++ compiler:

.code
lea     rbx, [__ImageBase]
mov     eax, [SwitchIndex]
add     eax, - LowerLimit
cmp     eax, Range
ja      LabelDefault
cdqe
mov     ecx, [imagerel(SwitchTable) + rbx + rax*4]
add     rcx, rbx
jmp     rcx

.data
SwitchTable label dword
dd      imagerel(Label1)
dd      imagerel(Label2)
dd      imagerel(Label3)

Some other compilers use the beginning of the switch table or the beginning of
the code section as reference point for 32-bit jump addresses. Other 
compilers use 64-bit addresses in the switch table. We want to recognize
all these patterns in order to disassemble a switch table in a comprehensible
way and find the case label targets.

In order to recognize a switch table in the above example, the tracer must
do the following tasks:

1.  Calculate the rip-relative address in the lea instruction and detect
that it is equal to the image base. 

2.  Remember that rbx contains the image base.

3.  When interpreting the mov ecx instruction it recognizes that the base
pointer contains the image base, therefore the displacement must be
interpreted as an image-relative address. Calculate this address and
give it a name.

4.  Remember that ecx contains an an element from the array SwitchTable.
It is not yet known that SwitchTable is a switch table.

5.  After add rcx,rbx remember that rcx contains an element from the array
SwitchTable plus the image base.

6.  When interpreting the jmp rcx instruction, the information about the 
contents of rcx is used for concluding that SwitchTable contains jump
addresses, and that these addresses are image-relative. If there had
been no add rcx,rbx, we would conclude that SwitchTable contains
absolute virtual addresses.

7.  Go through all elements of SwitchTable. Calculate the address that each
element points to, give it a name, and extend the scope of the current
function to include this target.

8.  It would be possible to determine the length of the switch table from
the cmp instruction, but the tracer does not currently use this 
information. Instead, it stops parsing the switch table at the first 
known label or the first invalid address.

This is quite a long way to go for acquiring this information, but it is 
necessary in order to tell what is code and what is data and to find out
where the function ends. Unfortunately, the MS compiler puts switch tables
in the code segment rather than in the data segment which would give better
caching and code prefetching. If the switch table was not identified as such,
it would be impossible to tell what is code and what is data.

The tracer is also used for identifying virtual function tables.

Values of SATracer::Regist[i] tells what kind of information register i contains:
0     Unknown contents
1     Contains image base
4     Contains a constant = Value[i]
8     Contains a value < Value[i]. (Not implemented yet)
0x10  Contains the value of a symbol. Value[i] contains the old index of the symbol
0x11  Contains the value of an array element. Value[i] contains the symbol old index of the array
0x12  Contains the value of an array element + image base. Value[i] contains the symbol old index of the array. (array may contain image-relative jump addresses)
0x13  Contains the value of an array element + array base. Value[i] contains the symbol old index of the array. (array may contain jump addresses relative to array base)
0x18  Contains the address of a symbol. Value[i] contains the symbol old index
0x19  Contains the address of an array element. Value[i] contains the symbol old index of the array
*/

void CDisassembler::UpdateTracer() {
    // Trace register values. See explanation above
    uint32 reg;                                   // Destination register number
    uint32 srcreg;                                // Source register number

    if (s.Operands[0] & 0xFF) {
        // There is a destination operand
        if ((s.Operands[0] & 0xFF) < 5 && (s.Operands[0] & 0x1000)) {
            // Destination operand is a general purpose register
            switch (s.Operands[0] & 0xF0000) {
            case 0x20000:
                // Register indicated by last bits of opcode byte
                reg = Get<uint8>(s.OpcodeStart2) & 7;
                // Check REX.B prefix
                if (s.Prefixes[7] & 1) reg |= 8;     // Add 8 if REX.B prefix
                break;
            case 0x30000:
                // Register indicated by rm bits of mod/reg/rm byte
                reg = s.RM;
                break;
            case 0x40000:
                // Register indicated by reg bits of mod/reg/rm byte
                reg = s.Reg;
                break;
            default:
                // Error. Don't know where to find destination register
                t.Reset();  return;
            }
        }
        else if ((s.Operands[0] & 0xFF) >= 0xA0 && (s.Operands[0] & 0xFF) <= 0xA9) {
            // Destination is al, ax, eax, or rax
            reg = 0;
        }
        else {
            // Destination is not a general purpose register
            return;
        }
    }
    else {
        // There is no destination operand
        return;
    }

    // Destination operand is a general purpose register
    if (OpcodeOptions & 4) {
        // Destination register is not changed
        return;
    }

    // Check the opcode to find out what has happened to this register
    switch (Opcodei) {
    case 0xB0: case 0xB1: case 0xB2: case 0xB3: 
    case 0xB4: case 0xB5: case 0xB6: case 0xB7:
    case 0xB8: case 0xB9: case 0xBA: case 0xBB: 
    case 0xBC: case 0xBD: case 0xBE: case 0xBF:
        // MOV register, constant
        t.Regist[reg] = 0;
        if (s.OperandSize < 32) {
            // Only part of register is changed
            return;
        }
        if (s.ImmediateRelocation) {
            if (s.OperandSize < WordSize || !(Relocations[s.ImmediateRelocation].Type & 0x21)) {
                // Wrong size or type of relocation
                return;
            }
            // Register contains the address of a symbol
            t.Regist[reg] = 0x18;
            t.Value [reg] = Relocations[s.ImmediateRelocation].TargetOldIndex;
            return;
        }

        // Register value is a known constant
        t.Regist[reg] = 4;
        // Save value
        switch (s.ImmediateFieldSize) {
        case 1:
            t.Value[reg] = Get<uint8>(s.ImmediateField);
            break;
        case 2:
            t.Value[reg] = Get<uint16>(s.ImmediateField);
            break;
        case 4: 
        case 8: // 64-bit value truncated to 32 bits
            t.Value[reg] = Get<uint32>(s.ImmediateField);
            break;
        default:
            // Error. Should not occur
            t.Regist[reg] = 0;
        }
        return;
        /* This part is currently unused:
        case 0x31: case 0x33: case 0x29: case 0x2B:
        // XOR or SUB. Check if source and destination is same register
        if ((s.Operands[0] & 0xFFFF) == (s.Operands[1] & 0xFFFF) && s.Reg == s.RM && s.OperandSize >= 32) {
        // XOR OR SUB with same source and destination produces zero
        t.Regist[reg] = 4;
        t.Value [reg] = 0;
        return;
        }
        break;
        */

    case 0x8D:
        // LEA
        if (s.AddressFieldSize == 4 && s.AddressRelocation && s.OperandSize >= 32) {
            // Register contains the address of a symbol
            if (!(Relocations[s.AddressRelocation].Type & 1) && WordSize < 64) {
                // Cannot follow position-independent code in 32 bit mode
                t.Regist[reg] = 0;  return;
            }
            t.Regist[reg] = 0x18;
            t.Value [reg] = Relocations[s.AddressRelocation].TargetOldIndex;
            // Check if symbol has name
            const char * SymName = Symbols.HasName(t.Value[reg]);
            if (SymName && strcmp(SymName, "__ImageBase") == 0) {
                // Symbol is imagebase
                t.Regist[reg] = 1;
            }
            // Check if base or index register
            if (s.BaseReg || s.IndexReg) t.Regist[reg]++;
            return;
        }
        if (!s.AddressRelocation && s.BaseReg && s.IndexReg && s.Scale == 0) {
            // LEA used as ADD

            if (t.Regist[s.BaseReg-1] == 1 && (t.Regist[s.IndexReg-1] & 0xFE) == 0x10) {
                // Adding imagebase to the value of a symbol or array element
                t.Regist[reg] = 0x12;
                t.Value [reg] = t.Value[s.IndexReg-1];
                return;
            }
            if (t.Regist[s.IndexReg-1] == 1 && (t.Regist[s.BaseReg-1] & 0xFE) == 0x10) {
                // Adding the value of a symbol or array element to the imagebase
                t.Regist[reg] = 0x12;
                t.Value [reg] = t.Value[s.BaseReg-1];
                return;
            }
            if ((((t.Regist[s.IndexReg-1] & 0xFE) == 0x18 && (t.Regist[s.BaseReg-1] & 0xFE) == 0x10)
                ||   ((t.Regist[s.IndexReg-1] & 0xFE) == 0x10 && (t.Regist[s.BaseReg-1] & 0xFE) == 0x18))
                &&     t.Value [s.IndexReg-1] == t.Value[s.BaseReg-1]) {
                    // Adding the value of an array element to the base address of same array.
                    // This is a computed jump address if array contains self-relative addresses
                    t.Regist[reg] = 0x13;
                    t.Value [reg] = t.Value[s.BaseReg-1];
                    return;
            }
        }
        break;

    case 0x89: case 0x8B: case 0x3B02:
        // MOV and MOVSXD instruction
        if (s.OperandSize < 32) break;          // Only part of register is changed
        if (!(s.MFlags & 1)) {
            // MOV reg,reg. Copy register contents
            if (Opcodei == 0x8B || Opcodei == 0x3B02) {
                // Source register indicated by rm bits
                srcreg = s.RM;
            }
            else {
                // Source register indicated by reg bits
                srcreg = s.Reg;
            }
            t.Regist[reg] = t.Regist[srcreg];
            t.Value [reg] = t.Value [srcreg];
            return;
        }
        // MOV reg,mem
        if (s.AddressFieldSize == 4 && s.AddressRelocation) {
            // Register contains the value of a symbol
            if (!(Relocations[s.AddressRelocation].Type & 1) && WordSize < 64) {
                // Cannot follow position-independent code in 32 bit mode
                t.Regist[reg] = 0;  return;
            }
            t.Regist[reg] = 0x10;
            t.Value [reg] = Relocations[s.AddressRelocation].TargetOldIndex;

            // Check if base or index register
            if (s.BaseReg || s.IndexReg) t.Regist[reg]++;
            return;
        }
        if (s.BaseReg && (t.Regist[s.BaseReg-1] & 0xFE) == 0x18) {
            // Memory operand has a base register which contains the address of a symbol
            // Destination register will contain value of same symbol
            t.Regist[reg] = 0x10;
            t.Value [reg] = t.Value[s.BaseReg-1];
            if (s.IndexReg || s.AddressFieldSize || (t.Regist[s.BaseReg-1] & 1)) {
                // There is an offset
                t.Regist[reg] |= 1;
            }
            return;
        }
        if (s.IndexReg && (t.Regist[s.IndexReg-1] & 0xFE) == 0x18 && s.BaseReg && s.Scale == 0) {
            // Same as above, base and index registers swapped, scale factor = 1
            t.Regist[reg] = 0x10;
            t.Value [reg] = t.Value[s.IndexReg-1];
            if (s.AddressFieldSize || (t.Regist[s.IndexReg-1] & 1)) {
                // There is an offset
                t.Regist[reg] |= 1;
            }
            return;
        }
        break;

    case 0x01: case 0x03:
        // ADD instruction
        if (s.OperandSize < 32) break;          // Only part of register is changed
        if (Opcodei == 0x03) {
            // Source register indicated by rm bits
            srcreg = s.RM;
        }
        else {
            // Source register indicated by reg bits
            srcreg = s.Reg;
        }
        if (t.Regist[srcreg] == 1 && (t.Regist[reg] & 0xFE) == 0x10) {
            // Adding imagebase to the value of a symbol or array element
            t.Regist[reg] = 0x12;
            return;
        }
        if (t.Regist[reg] == 1 && (t.Regist[srcreg] & 0xFE) == 0x10) {
            // Adding the value of a symbol or array element to the imagebase
            t.Regist[reg] = 0x12;
            t.Value [reg] = t.Value[srcreg];
            return;
        }
        if ((((t.Regist[srcreg] & 0xFE) == 0x18 && (t.Regist[reg] & 0xFE) == 0x10)
            ||   ((t.Regist[srcreg] & 0xFE) == 0x10 && (t.Regist[reg] & 0xFE) == 0x18))
            && t.Value [reg] == t.Value[srcreg]) {
                // Adding the value of an array element to the base address of same array.
                // This is a computed jump address if array contains self-relative addresses
                t.Regist[reg] = 0x13;
                return;
        }
        break;

    case 0x3902:
        // CDQE. eax sign extended to rax. Ignore
        return;
    case 0x3900: case 0x3901:
        // CBW, CWDE. rax changed
        t.Regist[0] = 0;
        return;
    case 0x3A00: case 0x3A01: case 0x3A02:
        // CWD, CDQ, CQO. rdx changed
        t.Regist[2] = 0;
        return;
    }
    // Anything else: Remember that this register is changed
    t.Regist[reg] = 0;

    if (OpcodeOptions & 8) {
        // Registers other than destination register may be changed
        t.Reset();
    }
}


void CDisassembler::UpdateSymbols() {
    // Find unnamed symbols, determine symbol types,
    // update symbol list, call CheckJumpTarget if jump/call.
    // This function is called during pass 1 for every instruction

    uint32 OpI;                                   // Operand index
    uint32 OperandType;                           // Type of operand
    uint32 SymOldI;                               // Symbol table old index
    uint32 SymNewI;                               // Symbol table new index

    // Loop through all operands for one instruction
    for (OpI = 0; OpI < 4; OpI++) {
        if (s.Operands[OpI]) {
            SymNewI = 0;                            // Reset symbol index
            OperandType = s.Operands[OpI];          // Operand type

            // Check if indirect jump/call
            if (OpI == 0 && ((s.OpcodeDef->Destination + 1) & 0xFE) == 0x0C) {
                OperandType = s.OpcodeDef->Destination;
            }

            // Check operand type
            if ((OperandType & 0xF0) == 0x80) {
                // This is a jump/call destination

                if (!s.ImmediateRelocation) {
                    // Has no reference to other symbol. Make one

                    // Relocation type
                    uint32 RelocationType = 2;        // Self relative
                    if ((OperandType & 0xFE) == 0x84) RelocationType = 8; // Far

                    // Scope
                    uint32 TargetScope = 1;           // Function local    
                    if ((OperandType & 0xFF) >= 0x83) TargetScope = 2;  // Call or far. File scope

                    // Make relocation and target symbol
                    SymNewI = MakeMissingRelocation(Section, s.ImmediateField, RelocationType, OperandType, TargetScope);

                    // Update labels
                    LabelBegin = 0;
                    FindLabels();

                    if (TargetScope == 1 && SymNewI) {
                        // Short or near jump (not call). Update range of current function
                        CheckJumpTarget(SymNewI);
                    }
                }
                else {
                    // Jump or call to relocated symbol
                    // Look up in Relocations table
                    SymOldI = Relocations[s.ImmediateRelocation].TargetOldIndex;

                    // Look up in symbol table
                    SymNewI = Symbols.Old2NewIndex(SymOldI);
                    if (Symbols[SymNewI].OldIndex) {
                        // Found
                        // Check if symbol already has a scope assigned
                        if (Symbols[SymNewI].Scope == 0) Symbols[SymNewI].Scope = 2;

                        // Check if symbol already has a type assigned
                        if ((OperandType & 0xFF) > (Symbols[SymNewI].Type & 0xFF)) {

                            // No type assigned yet, or new type overrides old type
                            Symbols[SymNewI].Type = (Symbols[SymNewI].Type & ~0xFF) | OperandType;
                        }
                        // Check if jump target is in data segment
                        if (Symbols[SymNewI].Section > 0 && (uint16)(Symbols[SymNewI].Section) < Sections.GetNumEntries()
                            && (Sections[Symbols[SymNewI].Section].Type & 0xFF) > 1) {
                                s.Warnings1 |= 0x80000;
                        }
                    }
                }
            }
            else {
                // Check if reference to data symbol
                if ((s.Operands[OpI] & 0x2000) && (s.Operands[OpI] & 0xD0000) == 0x10000) {
                    // Memory operand

                    if (s.AddressRelocation) {
                        // There is a reference to a data symbol

                        // Make exception for LEA: Target type is unknown
                        if (Opcodei == 0x8D) OperandType = 0;

                        // Check and update relocation target
                        CheckRelocationTarget(s.AddressRelocation, OperandType, GetDataItemSize(OperandType));
                    }
                    else if (s.AddressFieldSize >= 4) {
                        // Relocation missing. Make one if possible
                        uint32 TargetType = OperandType;
                        if (Opcodei == 0x8D) {
                            // Source of LEA instruction has no type
                            TargetType = 0;
                        }
                        // Check addressing mode
                        if (s.MFlags & 0x100) {
                            // There is a rip-relative reference
                            // Make relocation record and target record
                            MakeMissingRelocation(Section, s.AddressField, 2, TargetType, 2);
                            FindRelocations();
                        }
                        else if (s.BaseReg && t.Regist[s.BaseReg-1] == 1 && s.AddressFieldSize == 4) {
                            // Memory operand has a base register which has been traced
                            // to contain the image base. Make image-relative relocation
                            MakeMissingRelocation(Section, s.AddressField, 4, TargetType, 2);
                            FindRelocations();
                        }
                        else if (ImageBase && !(RelocationsInSource & 0x20) && s.AddressFieldSize >= 4) {
                            // No base relocations in source. Make direct relocation
                            MakeMissingRelocation(Section, s.AddressField, 1, TargetType, 2, s.AddressFieldSize);
                            FindRelocations();
                        }
                    }
                }
                if ((s.Operands[OpI] & 0xF0) >= 0x10 && (s.Operands[OpI] & 0xF0) < 0x40) {
                    // Immediate operand

                    if (!s.ImmediateRelocation && s.ImmediateFieldSize >= 4 
                        && ImageBase && !(RelocationsInSource & 0x20)
                        && (Opcodei == 0x3000 || Opcodei == 0x68 || (Opcodei & 0xFFF8) == 0xB8)) {
                            // instruction = MOV or PUSH, immediate operand may be an address
                            // Make a relocation if immediate value is valid address
                            MakeMissingRelocation(Section, s.ImmediateField, 1, 0, 2, s.ImmediateFieldSize);
                            FindRelocations();
                    }
                    if (s.ImmediateRelocation) {
                        // There is a reference to the offset of a data symbol
                        // Check and update relocation target
                        CheckRelocationTarget(s.ImmediateRelocation, 0, 0);
                    }
                }
            }
            if (((OperandType + 1) & 0xFE) == 0x0C) {
                // Indirect jump or call. Find jump table or virtual table

                // Default relocation type for jump table is direct
                uint32 RelocationType = 1;

                // Find symbol table entry for jump pointer or call pointer
                if (s.AddressRelocation && Relocations[s.AddressRelocation].TargetOldIndex) {
                    // Look up in symbol table
                    SymNewI = Symbols.Old2NewIndex(Relocations[s.AddressRelocation].TargetOldIndex);
                }
                else SymNewI = 0;

                if (SymNewI == 0 || Symbols[SymNewI].OldIndex == 0) {
                    // Symbol for jump table not found yet
                    if (s.Operands[OpI] & 0x2000) {
                        // There is a memory operand
                        if (s.BaseReg && (t.Regist[s.BaseReg-1] & 0xFE) == 0x18) {
                            // Memory operand has a base register which has been traced to
                            // point to a known symbol
                            SymNewI = Symbols.Old2NewIndex(t.Value[s.BaseReg-1]);
                        }
                        else if (((s.BaseReg != 0) ^ (s.IndexReg != 0)) && s.AddressFieldSize == 4 && ExeType) {
                            // Here is a jump table with an absolute address
                            SymNewI = MakeMissingRelocation(Section, s.AddressField, 1, 0x0B, 2, s.AddressFieldSize);
                        }
                    }
                    else {
                        // Jump or call to a register operand
                        // Check if the register value has been traced
                        if ((t.Regist[s.RM] & 0x1C) == 0x10) {
                            // Register contains an array element. Get symbol for this array
                            SymNewI = Symbols.Old2NewIndex(t.Value[s.RM]);
                            // Check relocation type
                            if (t.Regist[s.RM] == 0x12) {
                                // Register contains array element plus imagebase. 
                                RelocationType = 4;         // Array elements must have image-relative relocations
                            }
                            if (t.Regist[s.RM] == 0x13) {
                                // Register contains array element plus base address of same array
                                RelocationType = 0x10;         // Array elements must have self-relative relocations
                            }
                        }
                    }
                }
                // Check if valid symbol for jump/call table
                if (SymNewI && Symbols[SymNewI].OldIndex) {
                    // Jump/call table found

                    if ((s.Operands[OpI] & 0x2000) && !s.BaseReg && !s.IndexReg && Opcodei == 0x2704) {
                        // Simple memory operand
                        // Assign name if symbol is import table entry
                        CheckImportSymbol(SymNewI);
                    }

                    // Check relocation type if memory operand
                    if ((s.Operands[OpI] & 0x2000) && s.BaseReg && t.Regist[s.BaseReg-1] == 1) {
                        // Memory operand has a base register which has been traced to contain the imagebase
                        RelocationType = 4;               // Array elements must have image-relative relocations
                    }

                    // Check symbol type
                    if ((Symbols[SymNewI].Type & 0xFF) < (OperandType & 0xFF) /*|| (Symbols[SymNewI].Type & 0xF0)*/) {
                        // No type assigned yet, or new type overrides old type
                        Symbols[SymNewI].Type = OperandType;
                    }

                    // Check symbol size
                    if (RelocationType == 4 && WordSize > 16) {
                        Symbols[SymNewI].Size = 4;     // Image relative
                    }
                    if (RelocationType == 0x10 && WordSize > 16) {
                        Symbols[SymNewI].Size = 4;     // Relative to table base
                    }
                    else {
                        Symbols[SymNewI].Size = WordSize / 8; // Direct
                    }

                    // Follow what the jump/call table points to
                    FollowJumpTable(SymNewI, RelocationType);
                }
            }
        }
    }
}


void CDisassembler::FollowJumpTable(uint32 symi, uint32 RelType) {
    // Check jump/call table and its targets
    uint32 sym1, sym2, sym3 = 0;                  // Symbol indices
    uint32 NextLabel;                             // Offset of next label
    uint32 Pos;                                   // Current position
    SARelocation rel;                             // Relocation record for searching
    int32  Reli;                                  // Index to relocation
    uint32 NewType = 0;                           // Type to assign to symbol
    int32  SourceSection;                         // Section of relocation source
    uint32 SourceOffset;                          // Offset of relocation source
    uint32 SourceSize;                            // Size of relocation source
    uint32 TargetType;                            // Type for relocation target
    uint32 RefPoint = 0;                          // Reference point if relocationtype = 0x10
    int32  Addend = 0;                            // Inline addend

    // Check if sym is  valid
    if (Symbols[symi].OldIndex == 0) return;

    // Get type of target
    switch (s.OpcodeDef->Destination & 0xFF) {
    case 0x0B:  // Near indirect jump. Target type = jump destination
        NewType = 0x82;  break;
    case 0x0C:  // Near indirect call. Target type = call destination
        NewType = 0x83;  break;
    default:    // Should not occur
        return;
    }

    // Check symbol size
    if ((RelType & 4) && WordSize >= 32) {
        // Image relative relocation
        Symbols[symi].Size = 4;
    }
    else if ((RelType & 0x10) && WordSize >= 32) {
        // Relative to table base
        Symbols[symi].Size = 4;
        RefPoint = Symbols[symi].OldIndex; // Reference point = table base
    }
    else if ((RelType & 0x21) || Symbols[symi].Size == 0) {
        // Direct near relocation
        Symbols[symi].Size = WordSize / 8;
    }

    // Check symbol type
    if (uint32(s.OpcodeDef->Destination & 0xFF) > (Symbols[symi].Type & 0xFF)) {
        // No type assigned yet, or new type overrides old type
        Symbols[symi].Type = s.OpcodeDef->Destination | 0x4000000;
    }
    // Make sure symbol is marked as data
    Symbols[symi].Type |= 0x4000000;   

    // Check if symbol has a scope assigned
    if (Symbols[symi].Scope == 0) Symbols[symi].Scope = 2;

    // Save symbol properties
    // (The reference to sym will become invalid when new symbols are created)
    SourceSection = Symbols[symi].Section;
    SourceOffset  = Symbols[symi].Offset;
    SourceSize    = Symbols[symi].Size;
    TargetType    = 0x82; 
    
    // Target type = jump label
    if ((Symbols[symi].Type & 0xFF) == 0x0C) TargetType++;  // Target type = call label

    // Find next label
    sym1 = Symbols.FindByAddress(SourceSection, SourceOffset, &sym2, &sym3);
    if (sym1 && sym3) {
        // Assume that table ends at next label
        NextLabel = Symbols[sym3].Offset;
    }
    else {
        // No next label. End at source section end
        NextLabel = Sections[SourceSection].InitSize;
    }

    // Loop through table of jump/call addresses
    for (Pos = SourceOffset; Pos < NextLabel; Pos += SourceSize) {

        // Search for relocation source at table entry
        rel.Section = SourceSection;
        rel.Offset  = Pos;
        Reli = Relocations.Exists(rel);

        if (Reli > 0) {
            // Relocation found. Check target
            CheckRelocationTarget(Reli, TargetType, 0);
        }
        else {
            // No relocation here. Make one if possible

            uint32 symi = MakeMissingRelocation(rel.Section, rel.Offset, RelType, TargetType, 2, 0, RefPoint);
            if (!symi) {
                // Failed to make a meaningful relocation. End jump table
                break;
            }
            int32 TargetSection = Symbols[symi].Section;
            if (!TargetSection || (Sections[TargetSection].Type & 0xFF) != 1) {
                // Target is not in code section. End jump table
                break;
            }
            // Find the newly made relocation
            Reli = Relocations.Exists(rel);
            if (Reli <= 0) break;
        }
        // Relocation found. Check if valid
        if (!(Relocations[Reli].Type & 0x37) || !Relocations[Reli].TargetOldIndex) {
            // Wrong relocation type or invalid. Stop searching
            break;
        }
        // Find relocation target
        uint32 TargetSymI = Symbols.Old2NewIndex(Relocations[Reli].TargetOldIndex);
        if (!TargetSymI) {
            // Target invalid
            break;
        }

        // Calculate target address
        Addend = Relocations[Reli].Addend;
        // Check inline addend if target is section-relative and this is an object file
        if (!ExeType && Symbols[TargetSymI].Offset == 0) {

            switch (SourceSize) {
            case 2:
                Addend += *(int16*)(Sections[SourceSection].Start + Pos);
                break;
            case 4: case 8:
                Addend += *(int32*)(Sections[SourceSection].Start + Pos);
                break;
            default:
                Addend += 0;
            }
            if (Addend) {
                // Make new symbol at target address
                uint32 NewSymOffset = Addend;
                if (Relocations[Reli].Type & 2) {  // relative
                    if (RelType == 0x10) {  // arbitrary reference point                       
                        NewSymOffset -= (Relocations[Reli].Offset - SourceOffset);
                    }
                }
                uint32 NewSym = Symbols.NewSymbol(Symbols[TargetSymI].Section, NewSymOffset, 2);
                if (NewSym) TargetSymI = NewSym;
            }
        }

        // Update target symbol type
        if ((Symbols[TargetSymI].Type & 0xFF) < NewType) {
            Symbols[TargetSymI].Type = (Symbols[TargetSymI].Type & ~0xFF) | NewType;
        }
        // Extend current function to include target
        CheckJumpTarget(TargetSymI);

        // Update NextLabel in case new target is between Pos and NextLabel
        if (Symbols[TargetSymI].Section == SourceSection && Symbols[TargetSymI].Offset > Pos && Symbols[TargetSymI].Offset < NextLabel) {
            NextLabel = Symbols[TargetSymI].Offset;
        }
    }

    if (Pos < NextLabel) {
        // There is no label after jump table. Make one with zero scope
        SASymbol SymAfter;
        SymAfter.Reset();
        SymAfter.Section = SourceSection;
        SymAfter.Offset  = Pos;
        SymAfter.Type    = (Sections[SourceSection].Type & 0xFF) == 1 ? 0x82 : 0;
        Symbols.NewSymbol(SymAfter);
    }
}


uint32 CDisassembler::MakeMissingRelocation(int32 Section, uint32 Offset, uint32 RelType, uint32 TargetType, uint32 TargetScope, uint32 SourceSize, uint32 RefPoint) {
    // Make a relocation and its target symbol from inline address
    /* This function is used for executable files that have already been 
    relocated for making the relocation information that has been
    lost as well as the symbol record that the relocation should
    point to.
    Parameters:
    Section     Section of relocation source
    Offset      Offset of relocation source
    RelType     Relocation type: 1 = direct, 2 = self relative, 4 = image relative, 0x10 = relative to reference point
    TargetType  Symbol type for target
    TargetScope Scope for target symbol
    SourceSize  Size of source field (0 = default for relocation type and WordSize)
    RefPoint    Reference point if RelType = 0x10 (symbol old index)

    The return value is a symbol new index for the target, or zero if failure

    The size of the relocation source is implied from RelType
    A symbol record for the target will be made if none exists. 
    The scope of the target symbol will be file local (2)
    */

    SARelocation Rel;                             // Temporary relocation record
    SASymbol Sym;                                 // Temporary symbol record for target
    Sym.Reset();
    int32  irel;                                  // Relocation index
    uint32 isym = 0;                              // Symbol new index
    int64  InlineA;                               // Inline address or displacement
    int64  TargetAbsAddr;                         // Absolute address of target

    // Check if Section valid
    if (Section <= 0 || (uint32)Section >= Sections.GetNumEntries() || Offset >= Sections[Section].InitSize || !Sections[Section].Start) {
        return 0;
    }

    // Check if a relocation would be missing
    if (RelType & 1) {
        // Direct relocation
        if (RelocationsInSource & 0x20) return 0;  // Source file has base relocations. There would be a relocation here if needed
    }
    else if (RelType & 4) {
        // Image relative
        if (!ExeType) return 0;                    // Object file. There would be a relocation here if needed
    }

    // Check if a relocation already exists
    Rel.Section = Section;
    Rel.Offset  = Offset;
    irel = Relocations.Exists(Rel);
    if (irel > 0) return 0;                       // Relocation exists. Don't do anything

    if (SourceSize == 0) {
        // Source size not specified. Get default source size
        if ((TargetType & 0xFF) == 0x81) {
            // Short jump
            SourceSize = 1;
        }
        else if (RelType & 1) {
            // Direct relocation. Size depends on word size
            SourceSize = WordSize / 8;
        }
        else if (RelType & 0x12) {
            // Self relative or relative to table base
            SourceSize = (WordSize == 16) ? 2 : 4;
        }
        else if (RelType & 4 && WordSize > 16) {
            // Image relative
            SourceSize = 4;
        }
        else {
            // Other value. Ignore
            return 0;
        }
    }

    // Get inline address or displacement from source address
    if (SourceSize == 8) {
        InlineA = *(int64*)(Sections[Section].Start + Offset);
    }
    else if (SourceSize == 4) {
        InlineA = *(int32*)(Sections[Section].Start + Offset);
    }
    else if (SourceSize == 2) {
        InlineA = *(int16*)(Sections[Section].Start + Offset);
    }
    else { // 1
        InlineA = *(int8*)(Sections[Section].Start + Offset);
    }

    // Get absolute virtual address of target
    if (RelType & 1) {
        // Direct address
        TargetAbsAddr = InlineA;
    }
    else if (RelType & 2) {
        // Self relative. Translate self-relative to absolute address
        TargetAbsAddr = InlineA + ImageBase + SectionAddress + IEnd;
    }
    else if (RelType & 0x10) {
        // Relative to reference point. Translate relative to absolute address
        uint32 RefSym = Symbols.Old2NewIndex(RefPoint);
        TargetAbsAddr = InlineA + Symbols[RefSym].Offset + Sections[Symbols[RefSym].Section].SectionAddress;
    }
    else {
        // Image relative
        TargetAbsAddr = InlineA + ImageBase;
    }

    if (ExeType) {
        // Executable file
        // Translate to section:offset address
        if (TranslateAbsAddress(TargetAbsAddr, Sym.Section, Sym.Offset)) {

            // Make a symbol for this address if none exists
            Sym.Scope = TargetScope;
            Sym.Type  = TargetType;
            isym = Symbols.NewSymbol(Sym);
        }
        else if (TargetAbsAddr == ImageBase && TargetAbsAddr) {
            // Reference to image base (nonzero)
            // Make a symbol for image base if none exists
            Sym.Scope = 0x20;
            Sym.Type  = 0;
            isym = Symbols.NewSymbol(Sym);
            if (isym && Symbols[isym].Name == 0) {
                Symbols.AssignName(isym, "__ImageBase");
            }
        }
    }
    else {
        // Object file
        Sym.Section = Section;
        Sym.Offset  = (uint32)TargetAbsAddr - SectionAddress;

        // Make a symbol for this address if none exists
        Sym.Scope = TargetScope;
        Sym.Type  = TargetType;
        isym = Symbols.NewSymbol(Sym);
    }

    if ((RelType & 2) && (TargetType & 0xF0) == 0x80 && Sym.Section == Section && CodeMode == 1) {
        // Relocation not needed for relative jump/call within same section
        return isym;
    }

    if (isym) {
        // Relocation addend
        int32 Addend = -(int32)InlineA;
        if (RelType & 2) {
            // Correct self-relative record for bias
            if (s.MFlags & 0x100) {
                // rip-relative address
                Addend -= IEnd - s.AddressField;
            }
            else {
                // self-relative jump etc.
                Addend -= SourceSize;
            }
        }

        // Make a relocation record
        AddRelocation (Section, Offset, Addend, RelType, SourceSize, Symbols[isym].OldIndex, RefPoint);

        // Update s.AddressRelocation and s.ImmediateRelocation
        if (CodeMode & 3) {
            FindRelocations();

            // Remove warning for absolute address
            s.Warnings1 &= ~0x8000;
        }
    }
    return isym;
}


void CDisassembler::CheckImportSymbol(uint32 symi) {
    // Check for indirect jump to import table entry

    if (Symbols[symi].DLLName) {
        // Instruction is an indirect jump to symbol table entry
        // Find label at current instruction
        uint32 sym2 = Symbols.FindByAddress(Section, IBegin);
        if (sym2 && Symbols[sym2].Name == 0) {
            // Label at current instruction has no name
            // Give current instruction the import name without "_imp" prefix
            const char * ImpName = Symbols.GetName(symi);
            if (strncmp(ImpName, Symbols.ImportTablePrefix, (uint32)strlen(Symbols.ImportTablePrefix)) == 0) {
                Symbols.AssignName(sym2, ImpName + (uint32)strlen(Symbols.ImportTablePrefix));
            }
        }
    }
}

void CDisassembler::MarkCodeAsDubious() {
    // Remember that this may be data in a code segment
    uint32 sym1, sym2 = 0, sym3 = 0;              // Preceding and succeding symbols

    // Check likelihood that this is data rather than code
    if (((s.Errors & 0x4000) && ((s.Warnings1 & 0x10000000) || CountErrors > 1))
        || CountErrors > 5) {
            // There are more than 5 errors, or consecutive zeroes and at
            // least one more error or inaccessible code.
            // Consider this sufficient evidence that this is very unlikely 
            // to be code. Show it as data only
            CodeMode = 4;
    }
    if (CodeMode < 4) {
        // This may be code containing errors or interpreted out of phase.
        // Set CodeMode to dubious so that it will be shown as both code and data
        CodeMode = 2;
    }

    if (Pass & 0x0F) {
        // Pass 1. Mark preceding label as dubious

        // Check nearest preceding label
        if (LabelBegin == 0) {
            // There is no preceding label. Make one
            Symbols.NewSymbol(Section, IBegin, 1);
            LabelBegin = 0;
            FindLabels();
        }

        // Find symbol index for nearest preceding label
        sym1 = Symbols.FindByAddress(Section, LabelBegin, &sym2, &sym3);

        if (sym1 && sym2) {
            // Mark symbol as dubious or data
            Symbols[sym2].Type = (Symbols[sym2].Type & ~0xF000000) | (CodeMode << 24);
        }

        // Request repetition of pass 1
        Pass |= 0x100;

        /* Skip to next label.
        This is removed because we want to accumulate errors as evidence for 
        determined whether this is code or data
        // Is there a label after this?
        if (sym3) {
        // Skip to next label
        if (Symbols[sym3].Offset > IEnd) {
        IBegin = IEnd = Symbols[sym3].Offset;
        }
        }
        else {
        // No next label. Skip to section end
        IBegin = IEnd = SectionEnd;
        }
        */
    }
}


int CDisassembler::NextInstruction1() {
    // Go to next instruction or data item. Return 0 if none. Pass 1
    IBegin = IEnd;

    // Reset everything in s field
    s.Reset();

    // Return if there are more instructions
    return (IBegin < SectionEnd);
}

int CDisassembler::NextInstruction2() {
    // Go to next instruction or data item. Return 0 if none. Pass 2
    IBegin = IEnd;

    // Reset everything in s field
    s.Reset();

    // Return if there are more instructions
    return (IBegin < FunctionEnd && IBegin < LabelEnd && IBegin < SectionEnd);
}

void CDisassembler::ParseInstruction() {
    // Parse one opcode
    FlagPrevious = 0;                             // Reset flag from previous instruction

    s.OpcodeStart1 = IBegin;                      // Index to start of instruction

    // Scan prefixes first
    ScanPrefixes();

    // Find opcode map entry
    FindMapEntry();                               // Find entry in opcode maps

    // Find operands
    FindOperands();                               // Interpret mod/reg/rm and SIB bytes and find operands

    // Determine the types of each operand
    FindOperandTypes();

    if (s.Prefixes[3] == 0x62) {
        if (s.Prefixes[6] & 0x20) { // EVEX   
            FindBroadcast();                      // Find broadcast and offet multiplier for EVEX code
        }
        else {  // MVEX
            SwizTableLookup(); // Find swizzle table record if MVEX prefix
        }
    }

    // Find any relocation sources in this instruction
    FindRelocations();

    // Find any reasons for warnings
    FindWarnings();

    // Find any errors
    FindErrors();

    if (!s.Errors && CodeMode == 1) {
        // Find instruction set
        FindInstructionSet();

        // Update symbol types for operands of this instruction
        UpdateSymbols();

        // Trace register values
        UpdateTracer();
    }
}


void CDisassembler::ScanPrefixes() {
    // Scan prefixes
    uint32 i;                                            // Index to current byte
    uint8  Byte;                                         // Current byte of code
    for (i = IBegin; i < SectionEnd; i++) {

        // Read code byte
        Byte = Buffer[i];

        // Check if Byte is a prefix
        if (WordSize == 64 && (Byte & 0xF0) == 0x40) {

            // This is a REX prefix
            if (Byte & 0x08) {
                // REX.W prefix
                StorePrefix(4, 0x48);                    // REX.W also in category operand size
            }
            StorePrefix(7, Byte);                        // Store in category REX
        }
        else if (i+1 < SectionEnd &&         
            ((((Byte & 0xFE) == 0xC4 || Byte == 0x62) && (WordSize == 64 || (Buffer[i+1] >= 0xC0)))
            || (Byte == 0x8F && (Buffer[i+1] & 0x38)))) {
                // This is a VEX, EVEX, MVEX or XOP prefix

                // Check for invalid prefixes before this
                if (s.Prefixes[5] | s.Prefixes[7]) s.Warnings1 |= 0x800;

                // Get equivalent prefixes
                uint8 prefix3 = Byte;                    // Repeat prefix (F2, F3) or VEX prefix (C4, C5, 62)
                uint8 prefix4;                           // 66, 48 Operand size prefix
                uint8 prefix5;                           // 66, F2, F3 operand type prefixes
                uint8 prefix6;                           // VEX.mmmmm and VEX.L
                uint8 prefix7;                           // equivalent to REX prefix
                uint8 vvvv;                              // vvvv register operand
                if (Byte == 0xC5) {
                    // 2-bytes VEX prefix
                    if (i+2 >= SectionEnd) {
                        IEnd = i+2;
                        s.Errors |= 0x10; return;        // End of buffer reached
                    }
                    Byte = Buffer[++i];                  // Second byte
                    prefix5 = Byte & 3;                  // pp bits
                    prefix6 = (Byte << 3) & 0x20;        // L bit
                    prefix6 |= 1;                        // mmmmm bits = 1 for 0F map
                    vvvv = (~Byte >> 3) & 0x0F;          // vvvv operand
                    prefix7 = 0x10;                      // Indicate 2-bytes VEX prefix
                    prefix7 |= (~Byte >> 5) & 4;         // R bit
                }
                else {
                    // 3 or 4-bytes VEX/EVEX/MVEX prefix or XOP prefix
                    if (i+3+(Byte==0x62) >= SectionEnd) {
                        IEnd = i+3+(Byte==0x62);
                        s.Errors |= 0x10; return;        // End of buffer reached
                    }
                    prefix7 = (Byte == 0x8F) ? 0x80 : 0x20;// Indicate 3/4-bytes VEX prefix or XOP prefix
                    Byte = Buffer[++i];                  // Second byte
                    prefix6 = Byte & 0x1F;               // mmmmm bits
                    prefix7 |= (~Byte >> 5) & 7;         // R,X,B bits
                    Byte = Buffer[++i];                  // Third byte
                    prefix5 = Byte & 3;                  // pp bits
                    prefix6 |= (Byte << 3) & 0x20;       // VEX: L bit, MVEX: 0, EVEX: 1
                    vvvv = (~Byte >> 3) & 0x0F;          // vvvv operand
                    prefix7 |= (Byte >> 4) & 8;          // W bit
                    if (prefix3 == 0x62) {
                        // 4-bytes EVEX or MVEX prefix
                        prefix6 |= 0x40;                 // Indicates EVEX or MVEX prefix, bit 5 is 0 for MVEX, 1 for EVEX
                        Byte = Buffer[++i];              // Fourth byte
                        s.Kreg = Byte & 0x07;            // kkk mask register
                        vvvv |= (~Byte & 8) << 1;        // extra v bit
                        s.Esss = Byte >> 4;              // EVEX: zLLb, MVEX: Esss bits
                    }
                }
                StorePrefix(3, prefix3);                 // VEX prefix
                // Get operand size prefix
                prefix4 = (prefix5 == 1) ? 0x66 : 0;
                if (prefix7 & 8) prefix4 = 0x48;
                StorePrefix(4, prefix4);                // Operand size prefix
                // Translate operand type prefix values
                static const uint8 PrefixValues[4] = {0, 0x66, 0xF3, 0xF2};
                prefix5 = PrefixValues[prefix5];
                StorePrefix(5, prefix5);                // Operand type prefix
                StorePrefix(6, prefix6);                // VEX mmmmm,L
                StorePrefix(7, prefix7);                // REX prefix equivalent
                s.Vreg = vvvv;                          // Store vvvv operand
                // Next byte cannot be a prefix. Stop searching for prefixes
                s.OpcodeStart1 = i + 1;
                return;
        }
        else if (OpcodeMap0[Byte].InstructionFormat & 0x8000) {

            // This is a prefix (other than REX/VEX)
            switch (Byte) {
            case 0x26: case 0x2E: case 0x36: case 0x3E: case 0x64: case 0x65:
                // Segment prefix
                StorePrefix(0, Byte);                // Store prefix
                if (Byte == 0x64) MasmOptions |= 2;  // Remember FS used
                if (Byte == 0x65) MasmOptions |= 4;  // Remember GS used
                break;

            case 0x67:
                // Address size prefix
                StorePrefix(1, Byte);  break;

            case 0xF0:
                // Lock prefix
                StorePrefix(2, Byte);  break;

            case 0xF2: case 0xF3:
                // Repeat prefix
                StorePrefix(3, Byte);  // Both in category repeat and operand type
                StorePrefix(5, Byte);  break;

            case 0x66:
                // Operand size
                StorePrefix(4, Byte);  // Both in category operand size and operand type
                StorePrefix(5, Byte);  break;

            default:
                err.submit(9000);
            }
        }
        else {
            // This is not a prefix
            s.OpcodeStart1 = i;
            return;
        }
    }
    // Error: end of block reached before end of prefixes
    IEnd = i;
    s.Errors |= 0x10;
}


void CDisassembler::StorePrefix(uint32 Category, uint8 Byte) {
    // Store prefix according to category
    if (Category > 7) {err.submit(9000); return;} // Out of range

    // Check if we already have a prefix in this category
    if (s.Prefixes[Category]) {
        // We already have a prefix in this category
        if (s.Prefixes[Category] != Byte || Category == 7) {
            // Conflicting prefixes in this category
            s.Conflicts[Category]++;
        }
        else {
            // Same prefix occurs more than once
            s.Warnings1 |= 0x100;
        }
    }
    // Check if REX prefix before this
    if (s.Prefixes[7]) s.Errors |= 0x20;

    // Save prefix in category
    s.Prefixes[Category] = Byte;
}


void CDisassembler::FindMapEntry() {
    // Find entry in opcode maps
    uint32 i = s.OpcodeStart1;                    // Index to current byte
    uint16 Link;                                  // Link to another map
    uint8  Byte = Buffer[i];                      // Current byte of code or index into map
    uint32 MapNumber = 0;                         // Map number in opcodes.cpp
    uint32 StartPage;                             // Index to start page in opcode map
    uint32 MapNumber0 = 0;                        // Fallback start page if no map entry found in StartPage
    SOpcodeDef const * MapEntry;                  // Point to current opcode map entry

    // Get start page from VEX.mmmm or XOP.mmmm bits if any
    switch (s.Prefixes[3]) {
    default:   // no multibyte prefix
        StartPage = 0;
        MapEntry = OpcodeTables[StartPage] + Byte;
        break;
    case 0xC4: case 0xC5: case 0x62:                // 2-, 3-, or 4-bytes VEX prefix
        StartPage = s.Prefixes[6] & 0x0F;           // 4 mmmm bits or 0 if no VEX or XOP prefix
        if (StartPage >= NumOpcodeStartPageVEX) {
            s.Errors |= 0x10000; StartPage = 0;     // mmmm bits out of range
        }
        MapNumber = OpcodeStartPageVEX[StartPage]; 
        if (StartPage == 1) MapNumber0 = 1;
        if (StartPage == 2 && s.Prefixes[3] == 0x62) {
            if ((s.Prefixes[5] & 0xFE) == 0xF2) {   // shortcut for EVEX F2 0F 38 and EVEX F3 0F 38
                StartPage = 8 + (s.Prefixes[5] & 1); 
                MapNumber0 = MapNumber;
                MapNumber = OpcodeStartPageVEX[StartPage]; 
            }
        }

        // Get entry [Byte] in map
        MapEntry  = OpcodeTables[MapNumber] + Byte;
        
        // There are two entries for mm = 1: OpcodeMap1 for legacy code and OpcodeMapB1 for VEX-only code.
        // There are two entries for mm = 2: OpcodeMap2 for legacy code and OpcodeMapB2 for EVEX-only code with F3 prefix.
        // We don't want to have the same code in two different maps because this may cause errors if a code 
        // is updated only in one of the maps.
        // Search the shortcut map first, then the default map
        if ((MapEntry->Name == 0 && MapEntry->TableLink == 0) || Byte >= OpcodeTableLength[MapNumber]) {
            // not found here, try in default map
            MapNumber = MapNumber0;
            MapEntry  = OpcodeTables[MapNumber] + Byte;
        }
        if (MapNumber == 0) s.Errors |= 0x10000;   // no map found
        break;
    case 0x8F:  // XOP prefix
        StartPage = (s.Prefixes[6] & 0x1F) - 8;    // 4 mmmm bits or 0 if no VEX or XOP prefix
        if (StartPage >= NumOpcodeStartPageXOP) {
            s.Errors |= 0x10000; StartPage = 0;     // mmmm bits out of range
        }
        MapEntry = OpcodeStartPageXOP[StartPage] + Byte;// Get entry [Byte] in map
    }

    // Save previous opcode and options
    *(uint32*)&PreviousOpcodei = *(uint32*)&Opcodei;
    *(uint32*)&Opcodei = 0;

    // Loop through map tree (exit loop when Link == 0)
    while (1) {

        // Check if MapEntry has a link to another map
        Link = MapEntry->TableLink;

        switch (Link) {
        case 0:      // No link
            // Final map entry found
            s.OpcodeStart2 = i;
            s.OpcodeDef    = MapEntry;

            // Save opcode and options
            Opcodei = (MapNumber << 8) | Byte;
            OpcodeOptions = MapEntry->Options;

            // Return success
            return;

        case 1:      // Use following byte as index into next table
            if (i >= SectionEnd) {
                // Instruction extends beyond end of block
                IEnd = i;  s.Errors |= 0x10;
                s.OpcodeStart2 = i;
                return;
            }
            Byte = Buffer[++i];                     // Get next byte of code as index
            break;

        case 2:      // Use reg field of mod/reg/rm byte as index into next table
            Byte = (Buffer[i+1] >> 3) & 7;          // Read reg bits
            break;

        case 3:      // Use mod < 3 vs. mod == 3 as index into next table
            Byte = (Buffer[i+1] & 0xC0) == 0xC0;    // 1 if mod == 3
            break;

        case 4:      // Use mod and reg fields of mod/reg/rm byte as index into next table,
            // first 8 entries indexed by reg for mod < 3, next 8 entries indexed by reg for mod = 3.
            Byte = (Buffer[i+1] >> 3) & 7;          // Read reg bits
            if ((Buffer[i+1] & 0xC0) == 0xC0) Byte += 8; // Add 8 if mod == 3
            break;

        case 5:      // Use rm bits of mod/reg/rm byte as index into next table
            Byte = Buffer[i+1] & 7;                 // Read r/m bits
            break;

        case 6:      // Use immediate byte after any other operands as index into next table
            s.OpcodeStart2 = i;
            s.OpcodeDef    = MapEntry;
            FindOperands();                         // Find size of all operand fields and end of instruction
            Byte = Buffer[IEnd - 1];                // Last byte of instruction
            break;

        case 7:      // Use mode as index into next table (16, 32, 64 bits)
            switch (WordSize) {
            case 16:
                Byte = 0;  break;
            case 32: default:
                Byte = 1;  break;
            case 64: 
                Byte = 2;
            }
            break;

        case 8:      // Use operand size as index into next table (16, 32, 64 bits)
            switch (WordSize) {
            case 64:
                if (s.Prefixes[4] == 0x48) {         // REX.W prefix = 64 bit
                    Byte = 2;  break;
                }
            // Else continue in case 32:
            case 32: default:
                Byte = (s.Prefixes[4] == 0x66) ? 0 : 1;  break;
            case 16:
                Byte = (s.Prefixes[4] == 0x66) ? 1 : 0;  break;
            }
            break;

        case 9:      // Use operand type prefixes as index into next table (none, 66, F2, F3)
            switch (s.Prefixes[5]) {
            case 0: default:
                Byte = 0;  break;
            case 0x66:
                Byte = 1;  
                if (s.Prefixes[3] == 0xF2) Byte = 2;      // F2/F3 take precedence over 66 in (tzcnt instruction)
                else if (s.Prefixes[3] == 0xF3) Byte = 3;
                break;
            case 0xF2:
                Byte = 2;  break;
            case 0xF3:
                Byte = 3;  break;
            }
            break;

        case 0xA:    // Use address size as index into next table (16, 32, 64 bits)
            switch (WordSize) {
            case 64:
                Byte = (s.Prefixes[1] == 0x67) ? 1 : 2;  break;
            case 32: default:
                Byte = (s.Prefixes[1] == 0x67) ? 0 : 1;  break;
            case 16:
                Byte = (s.Prefixes[1] == 0x67) ? 1 : 0;  break;
            }
            break;

        case 0x0B:  // Use VEX prefix and VEX.L bits as index into next table
            // 0: VEX absent, 1: VEX.L=0, 2: VEX.L=1, 3:MVEX or EVEX.LL=2, 4: EVEX.LL=3
            // (VEX absent, VEX.L=0, VEX.L=1)
            if ((s.Prefixes[7] & 0xB0) == 0) {
                Byte = 0;                            // VEX absent
            }
            else if ((s.Prefixes[6] & 0x60) == 0x60) { // EVEX
                Byte = ((s.Esss >> 1) & 3) + 1; // EVEX.LL bits
            }
            else if ((s.Prefixes[6] & 0x60) == 0x40) { // MVEX
                Byte = 3;
            }
            else {  // VEX
                Byte = 1 + (s.Prefixes[6] >> 5 & 1); // 1 + VEX.L
            }
            break;

        case 0x0C:   // Use VEX.W bit as index into next table
            Byte = (s.Prefixes[7] & 0x08) >> 3;
            break;

        case 0x0D:   // Use vector size by VEX.L bit and EVEX/MVEX as index into next table
            // 0: VEX.L=0, 1: VEX.L=1, 2:MVEX or EVEX.LL=2, 3: EVEX.LL=3
            Byte = (s.Prefixes[6] >> 5) & 1;        // VEX.L indicates xmm or ymm
            if (s.Prefixes[3] == 0x62) {
                if (s.Prefixes[6] & 0x20) {
                    // EVEX. Use LL bits
                    Byte = (s.Esss >> 1) & 3;
                }
                else {
                    // MVEX. Always 512 bits
                    Byte = 2;
                }
            }             
            break;

        case 0x0E:   // Use VEX type as index into next table: 0 = 2 or 3 bytes VEX, 1 = 4 bytes EVEX
            Byte = (s.Prefixes[3] == 0x62);         // EVEX
            break;

        case 0x0F:   // Use MVEX.E bit as index into next table
            Byte = (s.Prefixes[3] == 0x62 && (s.Esss & 8));         // MVEX.E bit
            break;

        case 0x10:   // Use assembly language dialect as index into next table
            Byte = Syntax;
            break;

        case 0x11:   // Use VEX prefix type as index into next table. (0: none, 1: VEX prefix, 2: EVEX prefix, 3: MVEX prefix)
            if ((s.Prefixes[3] & ~1) == 0xC4) Byte = 1;   // 2 or 3-bytes VEX prefix
            else if (s.Prefixes[3] == 0x62) {             // EVEX or MVEX
                if (s.Prefixes[6] & 0x20) Byte = 2;       // EVEX
                else Byte = 3;                            // MVEX
            }
            else Byte = 0;                                // no VEX
            break;

        default:     // Internal error in map tree
            err.submit(9007, MapNumber);
            s.OpcodeStart2 = i;
            return;
        }

        // Get next map from branched tree of maps
        MapNumber = MapEntry->InstructionSet;
        if (MapNumber >= NumOpcodeTables1 || OpcodeTableLength[MapNumber] == 0) {
            err.submit(9007, MapNumber);  return;   // Map number out of range
        }

        // Use Byte as index into new map. Check if within range
        if (Byte >= OpcodeTableLength[MapNumber]) {
            // Points outside map. Get last entry in map containing default
            Byte = OpcodeTableLength[MapNumber] - 1;
        }
        // Point to entry [Byte] in new map
        MapEntry = OpcodeTables[MapNumber] + Byte;
        if (MapEntry == 0) {
            err.submit(9007, MapNumber);  return;   // Map missing
        }

    }  // Loop end. Go to next
}


void CDisassembler::FindOperands() {
    // Interpret mod/reg/rm and SIB bytes and find operands
    s.MFlags = 0;                                 // Memory operand flags:
    // 1 = has memory operand, 
    // 2 = has mod/reg/rm byte, 
    // 4 = has SIB byte, 
    // 8 = has DREX byte (AMD SSE5 instructions never implemented),
    // 0x10 = is rip-relative
    uint8 ModRegRM;                               // mod/reg/rm byte 
    uint8 SIB;                                    // SIB byte

    // Get address size   
    if (WordSize == 64) s.AddressSize = (s.Prefixes[1] == 0x67) ? 32 : 64;
    else s.AddressSize = (WordSize == 16) ^ (s.Prefixes[1] == 0x67) ? 16 : 32;

    s.AddressFieldSize = s.ImmediateFieldSize = 0;// Initialize

    // Position of next element in opcode
    s.AddressField = s.OpcodeStart2 + 1;

    // Check if there is a mod/reg/rm byte
    if (s.OpcodeDef->InstructionFormat & 0x10) {

        // There is a mod/reg/rm byte
        s.MFlags |= 2;

        if (s.OpcodeStart2 + 1 >= FunctionEnd) {
            CheckForMisplacedLabel();
        }

        // Read mod/reg/rm byte
        ModRegRM = Buffer[s.AddressField++];
        s.Mod =  ModRegRM >> 6;                    // mod = bit 6-7
        s.Reg = (ModRegRM >> 3) & 7;               // reg = bit 3-5
        s.RM  =  ModRegRM & 7;                     // RM  = bit 0-2

        // Check if there is a SIB byte
        if (s.AddressSize > 16 && s.Mod != 3 && s.RM == 4) {
            // There is a SIB byte
            s.MFlags |= 4;                          // Remember we have a SIB byte
            SIB = Buffer[s.AddressField++];         // Read SIB byte
            // Get scale, index, base
            s.Scale = SIB >> 6;               // Scale = bit 6-7
            s.IndexReg = (SIB >> 3) & 7;      // Index = bit 3-5
            s.BaseReg = SIB & 7;              // Base  = bit 0-2
        }

        // Check if there is a DREX byte (AMD SSE5 instructions never implemented):
        if ((s.OpcodeDef->InstructionFormat & 0x1E) == 0x14) {
            s.MFlags |= 8;                          // Remember we have a DREX byte
            s.Vreg = Buffer[s.AddressField++];      // Read DREX byte
            // The R,X,B bits of Vreg are equivalent to the corresponding bits of a REX prefix:
            s.Prefixes[7] |= (s.Vreg & 7) | 0x80;
        }

        if (s.AddressField > FunctionEnd) {
            CheckForMisplacedLabel();
        }

        // Check REX prefix
        if (s.Prefixes[7] & 4) s.Reg |= 8;         // Add REX.R to reg field
        if (s.Prefixes[7] & 1) s.RM  |= 8;         // Add REX.B to RM  field

        // Interpretation of mod/reg/rm byte is different for 16 bit address size
        if (s.AddressSize == 16) {

            if (s.Mod != 3) {
                // There is a memory operand
                s.MFlags |= 1;

                // Get size of address/displacement operand from mod bits
                // (Will be overwritten later if none)
                if (s.Mod == 1) {
                    s.AddressFieldSize = 1;           // Size of displacement field
                }
                else if (s.Mod == 2) {
                    s.AddressFieldSize = 2;           // Size of displacement field
                }

                // Check if direct memory operand
                if (s.Mod == 0 && s.RM == 6) {
                    // Direct memory operand and nothing else
                    s.AddressFieldSize = 2;           // Size of address field
                }
                else {
                    // Indirect memory operand
                    // Get base and index registers
                    // [bx+si], [bx+di], [bp+si], [bp+di], [si], [di], [bp], [bx]
                    static const uint8 BaseRegister [8] = {3+1, 3+1, 5+1, 5+1, 0, 0, 5+1, 3+1};
                    static const uint8 IndexRegister[8] = {6+1, 7+1, 6+1, 7+1, 6+1, 7+1, 0, 0};
                    // Save register number + 1, because 0 means none.
                    s.BaseReg  = BaseRegister [s.RM]; // Base register = BX or BP or none
                    s.IndexReg = IndexRegister[s.RM]; // Index register = SI or DI or none
                    s.Scale = 0;                      // No scale factor in 16 bit mode
                }
            }
        }
        else {
            // Address size is 32 or 64 bits

            if (s.Mod != 3) {
                // There is a memory operand
                s.MFlags |= 1;

                // Get size of address/displacement operand from mod bits
                // (Will be overwritten later if none)
                if (s.Mod == 1) {
                    s.AddressFieldSize = 1;              // Size of displacement field
                }
                else if (s.Mod == 2) {
                    s.AddressFieldSize = 4;              // Size of displacement field
                }

                // Check if direct memory operand
                if (s.Mod == 0 && (s.RM & 7) == 5) {
                    // Direct memory operand and nothing else
                    s.AddressFieldSize = 4;           // Size of address field
                }
                else if ((s.RM & 7) == 4) {
                    // There is a SIB byte

                    // Check REX prefix
                    if (s.Prefixes[7] & 2) s.IndexReg |= 8; // Add REX.X to index
                    if (s.Prefixes[7] & 1) s.BaseReg  |= 8; // Add REX.B to base
                    s.RM &= 7;                              // Remove REX.B from RM

                    s.BaseReg++;                      // Add 1 so that 0 means none
                    if (s.IndexReg == 4 && (s.OpcodeDef->InstructionFormat & 0x1F) != 0x1E) {
                        // No index register
                        s.IndexReg = 0;
                    }
                    else {
                        s.IndexReg++;                  // Add 1 so that 0 means none
                    }

                    if (s.Mod == 0 && s.BaseReg == 5+1) {
                        // No base register, 32 bit address
                        s.AddressFieldSize = 4;
                        s.BaseReg = 0;
                    }
                }
                else {
                    // Indirect memory operand and no SIB byte
                    s.BaseReg = s.RM;                 // Get base register from RM bits
                    s.BaseReg++;                      // Add 1 because 0 means none
                }
            }
            else {
                // No memory operand. Address size is 32 or 64 bits
            }
            // Check if rip-relative
            if (WordSize == 64 && (s.MFlags & 7) == 3 && !s.BaseReg && s.AddressFieldSize == 4) {
                // Memory operand is rip-relative
                s.MFlags |= 0x100;
            }
        }
        if (s.Prefixes[3] == 0x62) {
            // EVEX prefix gives another extra register bit
            s.Reg += ~(s.Prefixes[6]) & 0x10;        // extra r bit = highest m bit
            if (s.Mod == 3) {
                // Register operands only. B bit extended by X bit
                s.RM += (s.Prefixes[7] & 2) << 3;
            }
            else if (s.IndexReg && s.OpcodeDef->InstructionFormat == 0x1E) {
                // VSIB byte. Index register extended by one of the v bits, base register < 16
                s.IndexReg += s.Vreg & 0x10;
            }
        }
    }

    // Get operand size
    uint32 OpSizePrefix = 0;
    if (s.Prefixes[4] == 0x66 && (s.OpcodeDef->AllowedPrefixes & 0x100))  OpSizePrefix = 1; // Operand size prefix
    if (s.Prefixes[4] == 0x48 && (s.OpcodeDef->AllowedPrefixes & 0x1000)) OpSizePrefix = 2; // Rex.W prefix
    s.OperandSize = (WordSize == 16) ^ (OpSizePrefix & 1) ? 16 : 32;
    if (OpSizePrefix == 2) s.OperandSize = 64;
    if ((s.OpcodeDef->AllowedPrefixes & 0x3000) == 0x3000 && WordSize == 64 && (OpSizePrefix & 2)) s.OperandSize = 64;

    // Get any immediate operand
    // Offset to immediate operand field, if any
    s.ImmediateField = s.AddressField + s.AddressFieldSize;

    // Check InstructionFormat for immediate and direct operands
    switch (s.OpcodeDef->InstructionFormat & 0x0FE0) {
    case 0x20:  // Has 2 bytes immediate operand
        s.ImmediateFieldSize = 2;  break;

    case 0x40:  // Has 1 byte immediate operand or short jump
        s.ImmediateFieldSize = 1;  break;

    case 0x60:  // Has 3 bytes immediate operand (enter)
        s.ImmediateFieldSize = 3;  break;

    case 0x80:  // Has 2 or 4 bytes immediate operand or near jump/call
        if ((s.OpcodeDef->Destination & 0xFE) == 0x82) {
            // Near jump/call address size depends on WordSize and operand size prefix, 
            // but not on address size prefix
            s.ImmediateFieldSize = (WordSize == 16) ^ (s.Prefixes[4] == 0x66) ? 2 : 4;
            if (WordSize == 64) s.ImmediateFieldSize = 4; // 66 prefix ignored in 64 bit mode
        }
        else {
            // Size of other immediate data depend on operand size
            s.ImmediateFieldSize = (s.OperandSize == 16) ? 2 : 4;
        }
        break;

    case 0x100:  // Has 2, 4 or 8 bytes immediate operand
        s.ImmediateFieldSize = s.OperandSize / 8;
        break;

    case 0x200:  // Has 2+2 or 4+2 bytes far direct jump/call operand
        s.ImmediateFieldSize = (WordSize == 16) ^ (s.Prefixes[4] == 0x66) ? 4 : 6;
        break;

    case 0x400:  // Has 2, 4 or 8 bytes direct memory operand
        s.AddressFieldSize = s.AddressSize / 8;
        s.AddressField = s.ImmediateField;
        s.ImmediateField = s.AddressField + s.AddressFieldSize;
        s.ImmediateFieldSize = 0;
        break;

    default:     // No immediate operand
        s.ImmediateFieldSize = 0;
    }

    // Find instruction end
    IEnd = s.ImmediateField + s.ImmediateFieldSize;
    if (IEnd > FunctionEnd) {
        CheckForMisplacedLabel();
        if (IEnd > SectionEnd) {
            // instruction extends outside code block
            s.Errors |= 0x10; 
            IEnd = SectionEnd;
        }
    }
}

void CDisassembler::FindBroadcast() {
    // Find broadcast and offset multiplier for EVEX code
    if (s.Mod != 3) {
        // has memory operand        
        uint32 m;       // find memory operand
        for (m = 0; m < s.MaxNumOperands; m++) {
            if (s.Operands[m] & 0x2000) break;
        }
        if (m == s.MaxNumOperands) return;   // no memory operand found. should not occur
        uint32 r;       // find largest vector operand
        uint32 vectortype = 0;
        for (r = 0; r < s.MaxNumOperands; r++) {
            if ((s.Operands[r] & 0xF00) > vectortype) vectortype = s.Operands[r] & 0xF00;
        }
        uint32 vectorsize = GetDataItemSize(vectortype);
        if (m < s.MaxNumOperands) {
            if ((s.OpcodeDef->EVEX & 1) && (s.Esss & 1)) {
                // broadcasting. multiplier = element size
                s.OffsetMultiplier = GetDataElementSize(s.Operands[m]);
                // operand size = element size
                s.Operands[m] &= ~0xF00;
                if (s.OffsetMultiplier >= vectorsize) {
                    s.Warnings2 |= 0x200; // broadcasting to scalar
                }
            }
            else if (s.OpcodeDef->EVEX & 0x1000) {
                //  multiplier = element size, not broadcasting
                s.OffsetMultiplier = GetDataElementSize(s.Operands[m]);
            }
            else if (s.OpcodeDef->EVEX & 0x2000) {
                // multiplier = fraction of largest vector size
                s.OffsetMultiplier = vectorsize >> ((s.OpcodeDef->EVEX & 0x600) >> 9);
            }
            else {
                // not broadcasting. multiplier = vector size
                s.OffsetMultiplier = GetDataItemSize(s.Operands[m]);
            }
        }
    }
}


void CDisassembler::SwizTableLookup() {
    // Find the swizzle table record that correspond to the instruction and the sss bits for MVEX instructions
    int sw = (s.OpcodeDef->MVEX & 0x1F);  // swizzle metatable index
    int opsize = 0;                          // operand size override
    if (s.OpcodeDef->Options & 1) {
        // operand size depends on prefix bits
        if (s.OpcodeDef->AllowedPrefixes & 0x1000) {
            // operand size depends on W bit
            if (s.Prefixes[7] & 8) opsize = 1;
        }
        else if (s.OpcodeDef->AllowedPrefixes & 0x300) {
            // operand size depends on 66 implied prefix
            if (s.Prefixes[5] == 0x66) opsize = 1;
        }
    }
    int IsMem = s.Mod != 3;                  // has memory operand
    // find record in swizzle tables
    s.SwizRecord = &(SwizTables[sw | opsize][IsMem][s.Esss & 7]);
    // find offset multiplier
    if (s.OpcodeDef->MVEX & 0x40) {  
        // address single element
        s.OffsetMultiplier = s.SwizRecord->elementsize;
    }
    else {
        // address vector or subvector 
        s.OffsetMultiplier = s.SwizRecord->memopsize;
        if (s.OffsetMultiplier == 0) {
            // no swizzle, use vector size
            uint16 source = s.OpcodeDef->Source2;                 // last source operand
            if (!(source & 0xF00)) source = s.OpcodeDef->Source1; // if source2 is not a vector, use source1
            switch ((source >> 8) & 0xF) {
            case 2:
                // vector size depends on prefixes, currently only zmm supported when EVEX prefix is present
                s.OffsetMultiplier = 0x40;  break;
            case 4:
                s.OffsetMultiplier = 0x10;  break;
            case 5:
                s.OffsetMultiplier = 0x20;  break;
            case 6:
                s.OffsetMultiplier = 0x40;  break;
            }
        }
    }
}

void CDisassembler::FindOperandTypes() {
    // Determine the type of each operand
    uint32 i, j, k;                               // Operands index
    int nimm = 0;                                 // Number of immediate operands
    uint32 AllowedPref = s.OpcodeDef->AllowedPrefixes;
    uint32 oper;                                  // current operand definition

    s.MaxNumOperands = 4;  // may be 5 in the future in cases where EVEX field is used as an extra operand

    // Copy all operands from opcode map and zero-extend 
    for (i = 0; i < s.MaxNumOperands; i++) {
        s.Operands[i] = (&s.OpcodeDef->Destination)[i];
    }

    // Check instruction format
    switch (s.OpcodeDef->InstructionFormat & 0x1F) {

    case 2: // No operands or only immediate operand
        break;

    case 3: // Register operand indicated by bits 0-2 of opcode
        // Find which of the operands it applies to
        if ((s.Operands[0] & 0xFF) > 0 && (s.Operands[0] & 0xFF) < 0xB) i = 0; else i = 1;
        // Indicate this operand uses opcode bits
        s.Operands[i] |= 0x20000; 
        break;

    case 4: // Register operand indicated by VEX.vvvv bits
        // Find which of the operands it applies to
        if ((s.Operands[0] & 0xFF) < 0xB || (s.Operands[0] & 0xFF) == 0x95) i = 0; else i = 1;
        // Indicate this operand uses VEX.vvvv bits
        s.Operands[i] |= 0x60000;
        break;

    case 0x11: // There is a mod/reg/rm byte and one operand
        // Find which of the operands it applies to
        for (j = k = 0; j < 2; j++) {
            if (s.Operands[j]) {
                switch (s.Operands[j] & 0xF0) {
                case 0: case 0x40: case 0x50:
                    // This operand can have use rm bits
                    k |= j+1;
                }
            }
        }
        if (k < 1 || k > 2) {
            // There must be one, and only one, operand that can use rm bits
            s.Errors |= 0x80000;  // Error in opcode table
        }
        else {
            // Indicate this operand uses mod and rm bits
            s.Operands[k-1] |= 0x30000;
        }
        break;

    case 0x12: // There is a mod/reg/rm byte and two operands. Destination is reg
        // Destination operand uses s.Reg bits
        s.Operands[0] |= 0x40000; 
        // Source operand uses mod and rm bits
        s.Operands[1] |= 0x30000;
        break;

    case 0x13: // There is a mod/reg/rm byte and two operands. Source is reg
        // Destination operand uses mod and rm bits
        s.Operands[0] |= 0x30000;
        // Source operand uses s.Reg bits
        s.Operands[1] |= 0x40000; 
        break;

    case 0x14: case 0x15: { // There is a DREX byte and three or four operands
        // Combine OC0 from DREX byte and OC1 from opcode byte into Operand configuration
        int OperandConfiguration = ((s.Vreg >> 3) & 1) | ((Get<uint8>(s.OpcodeStart2) >> 1) & 2);
        // Determine operands
        s.Operands[0] |= 0x50000;                  // Destination determined by dest field of DREX byte
        if (s.OpcodeDef->InstructionFormat & 1) {
            // Four XMM or register operands
            switch (OperandConfiguration) {
    case 0:
        s.Operands[1]  = s.Operands[0];      // 1. source = same as destination
        s.Operands[2] |= 0x40000;            // 2. source = reg
        s.Operands[3] |= 0x30000;            // 3. source = rm
        break;
    case 1:
        s.Operands[1]  = s.Operands[0];      // 1. source = same as destination
        s.Operands[2] |= 0x30000;            // 2. source = rm
        s.Operands[3] |= 0x40000;            // 3. source = reg
        break;
    case 2:
        s.Operands[1] |= 0x40000;           // 1. source = reg
        s.Operands[2] |= 0x30000;           // 2. source = rm 
        s.Operands[3]  = s.Operands[0];     // 3. source = same as destination
        break;
    case 3:
        s.Operands[1] |= 0x30000;           // 1. source = rm
        s.Operands[2] |= 0x40000;           // 2. source = reg 
        s.Operands[3]  = s.Operands[0];     // 3. source = same as destination
        break;
            }
        }
        else {
            // Three XMM or register operands
            if ((OperandConfiguration & 1) == 0) {
                // OC0 = 0
                s.Operands[1] |= 0x40000;           // 1. source = reg
                s.Operands[2] |= 0x30000;           // 2. source = rm 
            }
            else {
                // OC0 = 1
                s.Operands[1] |= 0x30000;           // 1. source = rm
                s.Operands[2] |= 0x40000;           // 2. source = reg 
            }
        }
        break;}

    case 0x18: // Has VEX prefix and 2 operands
        // Dest = VEX.vvvv, src = rm, opcode extension in r bits. 
        // Destination operand uses VEX.vvvv bits
        s.Operands[0] |= 0x60000; 
        // Source1 operand uses mod and rm bits
        s.Operands[1] |= 0x30000;
        if (!(s.Prefixes[7] & 0xB0)) {
            // One operand omitted if no VEX prefix
            s.Operands[0] = s.Operands[1];  s.Operands[1] = 0;
        }
        break;   

    case 0x19: // Has VEX prefix and 3 operands
        // Dest = r, src1 = VEX.vvvv, src2 = rm. 
        s.Operands[0] |= 0x40000;
        s.Operands[1] |= 0x60000;
        s.Operands[2] |= 0x30000;
        if (!(s.Prefixes[7] & 0xB0)) {
            // One source operand omitted if no VEX prefix
            s.Operands[1] = s.Operands[2];  s.Operands[2] = 0;
        }
        // Preliminary AMD specification
        if ((AllowedPref & 0x7000) == 0x7000 && !(s.Prefixes[7] & 8)) {
            // Swap src1 and src2 if XOP prefix and XOP.W = 0
            k = s.Operands[1]; s.Operands[1] = s.Operands[2]; s.Operands[2] = k;
        }
        break;

    case 0x1A: // Has VEX prefix and 3 operands. 
        // Dest = rm, src1 = VEX.v, src2 = r
        s.Operands[0] |= 0x30000;
        s.Operands[1] |= 0x60000;
        s.Operands[2] |= 0x40000;
        if (!(s.Prefixes[7] & 0xB0)) {
            // One source operand omitted if no VEX prefix
            s.Operands[1] = s.Operands[2];  s.Operands[2] = 0;
        }
        break;

    case 0x1B: // Has VEX prefix and 3 operands
        // Dest = r, src1 = rm, src2 = VEX.vvvv
        s.Operands[0] |= 0x40000;
        s.Operands[1] |= 0x30000;
        s.Operands[2] |= 0x60000;
        if (!(s.Prefixes[7] & 0xB0)) {
            // Last source operand omitted if no VEX prefix
            s.Operands[2] = 0;
        }
        break;

    case 0x1C: // Has VEX prefix and 4 operands
        // Dest = r,  src1 = VEX.v, src2 = rm, src3 = bits 4-7 of immediate byte
        s.Operands[0] |= 0x40000;
        s.Operands[1] |= 0x60000;
        s.Operands[2] |= 0x30000;
        s.Operands[3] |= 0x70000;
        if ((s.Prefixes[7] & 8) && (AllowedPref & 0x7000) == 0x7000) {
            // Swap src2 and src3 if VEX.W
            k = s.Operands[2]; s.Operands[2] = s.Operands[3]; s.Operands[3] = k;
        }
        nimm++;                                    // part of immediate byte used
        break;

    case 0x1D: // Has VEX prefix and 4 operands
        // Dest = r,  src1 = bits 4-7 of immediate byte, src2 = rm, src3 = VEX.vvvv
        s.Operands[0] |= 0x40000;
        s.Operands[1] |= 0x70000;
        s.Operands[2] |= 0x30000;
        s.Operands[3] |= 0x60000;
        if ((s.Prefixes[7] & 8) && (AllowedPref & 0x7000) == 0x7000) {
            // Swap src2 and src3 if VEX.W
            k = s.Operands[2]; s.Operands[2] = s.Operands[3]; s.Operands[3] = k;
        }
        nimm++;                                    // part of immediate byte used
        break;

    case 0x1E: // Has VEX prefix, VSIB and 1, 2 or 3 operands. 
        if (s.Operands[0] & 0x2000) {
            // destination is memory
            // Dest = rm, src1 = r
            s.Operands[0] |= 0x30000;
            s.Operands[1] |= 0x40000;
            //if (s.Operands[2]) s.Operands[2] |= 0x60000;
        }
        else {
            // Dest = r, src1 = rm, src2 = VEX.v
            if (s.Operands[0]) s.Operands[0] |= 0x40000;
            s.Operands[1] |= 0x30000;
            if (s.Operands[2]) s.Operands[2] |= 0x60000;
        }
        break;

    default: // No explicit operands. 
        // Check for implicit memory operands
        for (i = 0; i < 2; i++) {
            if (s.Operands[i] & 0x2000) {
                // Direct memory operand
                s.Operands[i] |= 0x10000;
                if (s.OpcodeDef->InstructionFormat > 1) {
                    // There is an address field
                    s.AddressFieldSize = s.AddressSize / 8; 
                    s.AddressField = s.OpcodeStart2 + 1;
                    s.MFlags |= 1;                    // Remember we have a memory operand
                }
            }
        }
        break;
    }

    // Loop for destination and source operands
    for (i = 0; i < s.MaxNumOperands; i++) {
        // Ignore empty operands
        if (s.Operands[i] == 0) continue;

        // Immediate operands
        if ((s.Operands[i] & 0xFF) >= 0x10 && (s.Operands[i] & 0xFF) < 0x40) {
            if (nimm++) {
                s.Operands[i] |= 0x200000;           // second immediate operand
            }
            else {
                s.Operands[i] |= 0x100000;           // first immediate operand
            }
        }

        // Check if register or memory
        switch (s.Operands[i] & 0x3000) {
        case 0x1000:  // Must be register
            if ((s.Operands[i] & 0xF0000) == 0x30000 && s.Mod != 3 && (s.OpcodeDef->InstructionFormat & 0x10)) {
                s.Errors |= 8;                       // Is memory. Indicate wrong operand type
                s.Operands[i] = (s.Operands[i] & ~0x1000) | 0x2000;// Indicate it is memory
            }
            break;

        case 0x2000: // Must be memory operand
            if ((s.Operands[i] & 0xD0000) != 0x10000 || s.Mod == 3) {
                s.Errors |= 8;                       // Is register. Indicate wrong operand type
                s.Operands[i] = (s.Operands[i] & ~0x2000) | 0x1000; // Indicate it is register
            }
            break;

        case 0x0000: // Can be register or memory
            if ((s.Operands[i] & 0xF0000) == 0x10000) {
                // Direct memory operand
                s.Operands[i] |= 0x2000;  break;
            }
            if ((s.Operands[i] & 0xF0000) == 0x30000) {
                // Indicated by mod/rm bits
                if (s.Mod == 3) {
                    s.Operands[i] |= 0x1000;          // Is register
                }
                else {
                    s.Operands[i] |= 0x2000;          // Is memory
                }
                break;
            }
            if ((s.Operands[i] & 0xF0) != 0x10) {   // Not a constant
                s.Operands[i] |= 0x1000;             // Anything else is register
            }
            break;
        }

        // Resolve types that depend on prefixes or WordSize
        switch (s.Operands[i] & 0xFF) {
        case 8: case 0x18: case 0x28: case 0x38: case 0xA8: 
            // 16 or 32 bits
            s.Operands[i] &= ~0x0F;
            s.Operands[i] |= (s.OperandSize == 16) ? 2 : 3;
            break;

        case 9: case 0x19: case 0x29: case 0x39: case 0xA9: 
            // 8, 16, 32 or 64 bits, depending on operand size prefixes
            s.Operands[i] &= ~0x0F;
            switch (AllowedPref & 0x7000) {
            case 0x3000: default: // 32 or 64 depending on mode and 66 or REX.W prefix
                s.Operands[i] |= (s.OperandSize == 16) ? 2 : ((s.OperandSize == 64) ? 4 : 3);
                break;
            case 0x4000:  // VEX.W prefix determines integer (vector) operand size b/w
                if ((s.Prefixes[7] & 8) == 0) {  // W bit                
                    s.OperandSize = 8;                
                    s.Operands[i] |= 1;
                }
                else {
                    s.OperandSize = 16;                
                    s.Operands[i] |= 2;
                }
                break;
            case 0x5000:  // VEX.W and 66 prefix determines integer operand size b/w/d/q (mask instructions. B = 66W0, W = _W0, D = 66W1, Q = _W1)
                s.Operands[i] |= (s.Prefixes[5] != 0x66) + ((s.Prefixes[7] & 8) >> 2) + 1;
                break;
            }
            break;

        case 0xB: case 0xC: // 16, 32 or 64 bits. Fixed size = 64 in 64 bit mode
            s.Operands[i] &= ~0x0F;
            if (WordSize == 64) {
                s.Operands[i] |= 4;
            }
            else {
                s.Operands[i] |= (s.OperandSize == 16) ? 2 : 3;
            }
            break;

        case 0xA: // 16, 32 or 64 bits. Default size = 64 in 64 bit mode
            s.Operands[i] &= ~0x0F;
            if (WordSize == 64) {
                s.Operands[i] |= (s.OperandSize == 16) ? 2 : 4;
            }
            else {
                s.Operands[i] |= (s.OperandSize == 16) ? 2 : 3;
            }
            break;

        case 0xD: // 16+16, 32+16 or 64+16 bits far indirect pointer (jump or call)
            s.Operands[i] &= ~0x0F;
            s.Operands[i] |= (s.OperandSize == 16) ? 3 : ((s.OperandSize == 64) ? 5 : 7);
            break;

        case 0x4F: // XMM float. Size and precision depend on prefix bits
            s.Operands[i] &= ~0x7F;  // remove type
            if ((AllowedPref & 0x1000) && !((AllowedPref & 0xF00) == 0xE00)) {
                // precision depends on VEX.W bit
                if (s.Prefixes[7] & 8) {
                    s.Operands[i] |= 0x4C;
                }
                else {
                    s.Operands[i] |= 0x4B;
                }
            }
            else {
                // Size and precision depend on prefix: none = ps, 66 = pd, F2 = sd, F3 = ss
                switch (s.Prefixes[5]) {
                case 0:  // No prefix = ps
                    s.Operands[i] |= 0x4B;  break;
                case 0x66: // 66 prefix = pd
                    s.Operands[i] |= 0x4C;  break;
                case 0xF3: // F3 prefix = ss
                    s.Operands[i] |= 0x4B;  
                    s.Operands[i] &= ~0xF00;  // make scalar
                    break;
                case 0xF2: // F2 prefix = sd
                    s.Operands[i] |= 0x4C;  
                    s.Operands[i] &= ~0xF00;  // make scalar
                    break;
                };
                break;
            }
        }

        // Resolve vector size
        switch (s.Operands[i] & 0xF00) {
        case 0x100: // MMX or XMM or YMM or ZMM depending on 66 prefix and VEX.L prefix and EVEX prefix
        case 0x200: // XMM or YMM or ZMM depending on prefixes
        case 0xF00: // Half the size defined by VEX.L prefix and EVEX.LL prefix. Minimum size = 8 bytes for memory, xmm for register

            oper = s.Operands[i] & ~0xF00;           // element type
            if (s.Prefixes[3] == 0x62) {             // EVEX or MVEX prefix
                if (s.Prefixes[6] & 0x20) {
                    // EVEX prefix
                    // Do LL bits specify vector size when b = 1 for instructions that allow 
                    // sae but not rounding? Perhaps not, because sae is only allowed for
                    // 512 bit vectors, but manual says otherwise. 
                    // NASM version 2.11.06 sets LL = 0 when b = 1 for vrangeps instruction
                    //??if ((s.OpcodeDef->EVEX & 4) && (s.Mod == 3) && (s.Esss & 1)) {
                    if ((s.OpcodeDef->EVEX & 6) && (s.Mod == 3) && (s.Esss & 1)) {
                        // rounding control, register operand. L'L do not indicate vector size
                        oper |= 0x600;      // zmm
                    }
                    else if (s.OpcodeDef->EVEX & 8) {
                        // scalar
                        oper |= 0x400;      // xmm
                    }
                    else {
                        // L'L indicates vector size
                        oper |= 0x400 + ((s.Esss & 6) << 7); // xmm, ymm, zmm,
                    }
                }
                else {
                    // MVEX prefix
                    oper |= 0x600;          // zmm
                }
            }
            else if (s.Prefixes[6] & 0x20) {
                oper |= 0x500;              // VEX.L: ymm
            }
            else if (s.Prefixes[5] == 0x66 || (s.Operands[i] & 0x200)) {
                oper |= 0x400;              // 66 prefix or mm not allowed: xmm
            }
            else {
                oper |= 0x300;              // no prefix: mm
            }
            if ((s.Operands[i] & 0xF00) == 0xF00) {
                // half size vector
                oper -= 0x100;
                if ((oper & 0x1000) || (s.OpcodeDef->InstructionFormat == 0x1E)) {
                    // is register or vsib index. minimum size is xmm
                    if ((oper & 0xF00) < 0x400) {
                        oper = (oper & ~0x300) | 0x400;
                    }
                }
            }
            s.Operands[i] = oper;                     // save corrected vector size

            break;
        }

        // resolve types that depend on MVEX swizzle
        if ((s.Prefixes[6] & 0x60) == 0x40 && (s.Operands[i] & 0xF0000) == 0x30000) {
            int sw = (s.OpcodeDef->MVEX & 0x1F);
            if (sw) {
                int optype = s.SwizRecord ? s.SwizRecord->memop : 0; //?
                if (s.OpcodeDef->InstructionFormat == 0x1E) {
                    // vsib addressing: s.Operands[i] & 0xF00 indicates index register size, s.Operands[i] & 0xFF indicates operand size
                    s.Operands[i] = (s.Operands[i] & ~0xFF) | (optype & 0xFF);
                }
                else if (s.OpcodeDef->MVEX & 0x40) {
                    // operand is not a full vector
                    s.Operands[i] = (s.Operands[i] & ~0xFFF) | (optype & 0xFF);
                }
                else {
                    // get operand type from swizzle table only
                    if (optype) s.Operands[i] = optype | 0x30000;
                }
            }
        }
    }
}


void CDisassembler::FindWarnings() {
    // Find any reasons for warnings in code
    uint32 i;                                     // Operand index
    uint32 OperandSize;                           // Operand size
    uint8 RexBits = 0;                            // Bits in REX prefix

    if ((s.OpcodeDef->Options & 0x80) && s.ImmediateFieldSize > 1 && s.ImmediateRelocation == 0) {
        // Check if sign-extended operand can be used
        if ((s.ImmediateFieldSize == 2 && Get<int16>(s.ImmediateField) == Get<int8>(s.ImmediateField)) 
            ||  (s.ImmediateFieldSize == 4 && Get<int32>(s.ImmediateField) == Get<int8>(s.ImmediateField))) {
                s.Warnings1 |= 1; // Sign-extended operand could be used
        }
    }
    if (WordSize == 64 && s.ImmediateFieldSize == 8 && s.ImmediateRelocation == 0) {
        // We have a 64 bit immediate operand. Could it be made shorter?
        if (Get<uint32>(s.ImmediateField+4) == 0) {
            s.Warnings1 |= 2;                        // Upper half is zero. Could use zero-extension
        }
        else if (Get<int64>(s.ImmediateField) == Get<int32>(s.ImmediateField)) {
            s.Warnings1 |= 1;                        // Could use sign-extension
        }
    }
    // Check if displacement could be made smaller
    if (s.AddressFieldSize > 0 && s.AddressRelocation == 0 
        && (s.BaseReg || (s.IndexReg && !s.BaseReg && s.Scale < 2))
        && s.OffsetMultiplier <= 1) {
            // There is a displacement which might be unnecessary
            switch (s.AddressFieldSize) {
            case 1:  // 1 byte displacement
                if (Get<uint8>(s.AddressField) == 0 
                    && (((s.BaseReg-1) & 7) != 5 || (s.AddressSize == 16 && s.IndexReg))) 
                    s.Warnings1 |= 4; // Displacement is 0 and an addressing mode without displacement exists
                break;
            case 2:  // 2 bytes displacement
                if (Get<int16>(s.AddressField) == 0) s.Warnings1 |= 4; // Displacement is 0
                else if (Get<int16>(s.AddressField) == Get<int8>(s.AddressField)) s.Warnings1 |= 8; // Could use sign extension
                break;
            case 4:  // 4 bytes displacement
                if (s.OpcodeDef->InstructionFormat != 0x1E) {
                    if (Get<int32>(s.AddressField) == 0) s.Warnings1 |= 4; // Displacement is 0
                    else if (Get<int32>(s.AddressField) == Get<int8>(s.AddressField)) s.Warnings1 |= 8; // Could use sign extension
                }
                break;
            case 8:  // 8 bytes displacement
                if (Get<int32>(s.AddressField) == Get<int64>(s.AddressField)) 
                    // Has 8 bytes displacement. Could use sign-extended or rip-relative
                    s.Warnings1 |= 8;
                break;
            }
    }
    // Check for unnecessary SIB byte
    if ((s.MFlags&4) && (s.BaseReg&7)!=4+1 && (s.IndexReg==0 || (s.BaseReg==0 && s.Scale==0))) {
        if (WordSize == 64 && s.BaseReg==0 && s.IndexReg==0) s.Warnings1 |= 0x4000; // 64-bit address not rip-relative
        else if ((s.Operands[0] & 0xFF) != 0x98 && (s.Operands[1] & 0xFF) != 0x98 && s.OpcodeDef->InstructionFormat != 0x1E) { // ignore if bounds register used or vsib
            s.Warnings1 |= 0x10; // Unnecessary SIB byte
        }
    }
    // Check if shorter instruction exists for register operands
    if ((s.OpcodeDef->Options & 0x80) && !(s.OpcodeDef->InstructionFormat & 0xFE0) && s.Mod == 3
        && !(WordSize == 64 && Get<uint8>(s.OpcodeStart1) == 0xFF)) {
            s.Warnings1 |= 0x20;   // No memory operand. A shorter version exists for register operand
    }
    // Check for length-changing prefix
    if (s.ImmediateFieldSize > 1 && s.Prefixes[4] == 0x66 
        && (s.OpcodeDef->AllowedPrefixes & 0x100) && !(s.OpcodeDef->InstructionFormat & 0x20)) {
            // 66 prefix changes length of immediate field
            s.Warnings1 |= 0x40;
    }
    // Check for bogus length-changing prefix causing stall on Intel Core2.
    // Will occur if 66 prefix and first opcode byte is F7 and there is a 16 bytes boundary between opcode byte and mod/reg/rm byte
    if (Get<uint8>(s.OpcodeStart1) == 0xF7 && s.Prefixes[4] == 0x66 && ((s.OpcodeStart1+1) & 0xF) == 0 && !s.ImmediateFieldSize) {
        s.Warnings1 |= 0x2000000;
    }
    // Warn for address size prefix if mod/reg/rm byte
    // (This does not cause a stall in 64 bit mode, but I am issueing a 
    // warning anyway because the changed address size is probably unintended)
    if (s.Prefixes[1] == 0x67 && (s.MFlags & 2)) {
        s.Warnings1 |= 0x80;
    }
    // Check for unnecessary REX.W prefix
    if ((s.OpcodeDef->AllowedPrefixes & 0x7000) == 0x2000 && s.Prefixes[7] == 0x48) {
        s.Warnings1 |= 0x200;  // REX.W prefix valid but unnecessary
    }
    // Check for meaningless prefixes
    if (!(s.OpcodeDef->InstructionFormat & 0x10) || s.Mod == 3) {
        // No mod/reg/rm byte or only register operand. Check for address size and segment prefixes
        if ((s.Prefixes[0] && !(s.OpcodeDef->AllowedPrefixes & 0xC))
            || (s.Prefixes[1] && !(s.OpcodeDef->AllowedPrefixes & 3))) {
                s.Warnings1 |= 0x400; // Unnecessary segment or address size prefix
        }
    }

    // Check for meaningless segment prefixes
    if (s.Prefixes[0] && !(s.OpcodeDef->AllowedPrefixes & 0x0C)) {
        // Segment prefix is not branch hint
        if (WordSize == 64 && (s.Prefixes[0] & 0x02)) 
            s.Warnings1 |= 0x400; // CS, DS, ES or SS prefix in 64 bit mode has no effect
        if (s.Prefixes[0] == 0x3E && s.BaseReg != 4+1 && s.BaseReg != 5+1) 
            s.Warnings1 |= 0x400; // Unnecessary DS: segment prefix
        if (s.Prefixes[0] == 0x36 && (s.BaseReg == 4+1 || s.BaseReg == 5+1) )
            s.Warnings1 |= 0x400; // Unnecessary SS: segment prefix
        if (Opcodei == 0x8D)
            s.Warnings1 |= 0x400; // Segment prefix on LEA instruction
        if (s.Mod == 3)
            s.Warnings1 |= 0x400; // mod/reg/rm byte indicates no memory operand
    }

    // Check for meaningless 66 prefix
    if (s.Prefixes[4] == 0x66 && !(s.OpcodeDef->AllowedPrefixes & 0x380))
        s.Warnings1 |= 0x400; // 66 prefix not allowed here

    // Check for meaningless F2 prefix
    if (s.Prefixes[3] == 0xF2 && !(s.OpcodeDef->AllowedPrefixes & 0x868))
        s.Warnings1 |= 0x400; // F2 prefix not allowed here

    // Check for meaningless F3 prefix
    if (s.Prefixes[3] == 0xF3 && !(s.OpcodeDef->AllowedPrefixes & 0x460))
        s.Warnings1 |= 0x400; // F3 prefix not allowed here

    // Check for meaningless REX prefix bits
    if (s.Prefixes[7]) {
        // REX, VEX, XOP or DREX present
        // Get significant bits
        RexBits = s.Prefixes[7] & 0x0F;
        // Check if empty REX prefix
        if (RexBits == 0 && (s.Prefixes[7] & 0x40) && (s.Operands[0] & 0xFF) != 1 && (s.Operands[1] & 0xFF) != 1) {
            // Empty REX prefix needed only if 8 bit register register
            s.Warnings1 |= 0x400;
        }
        // Clear bits that are used:
        // Check if REX.W bit used
        if (s.OpcodeDef->AllowedPrefixes & 0x3000) RexBits &= ~8;
        // Check if REX.R and REX.B bit used for source or destination operands
        for (i = 0; i < 4; i++) {
            switch (s.Operands[i] & 0xF0000) {
            case 0x40000: // uses reg bits, check if REX.R allowed
                if ((s.Operands[i] & 0xF00) != 0x300 && (s.Operands[i] & 0x58) != 0x40 && (s.Operands[i] & 0xFF) != 0x91)
                    // REX.R used for operand and register type allows value > 7
                    RexBits &= ~4;
                break;
            case 0x30000: // Uses rm bits. check if REX.B allowed
                if ((s.Operands[i] & 0xF00) != 0x300 && (s.Operands[i] & 0x58) != 0x40 && (s.Operands[i] & 0xFF) != 0x91)
                    // REX.B used for operand and register type allows value > 7
                    RexBits &= ~1;
                break;
            case 0x20000: // Register operand indicated by opcode bits and REX:B
                RexBits &= ~1;
                break;
            }
        }
        // Check if REX.X bit used for index register
        if (s.IndexReg) RexBits &= ~2;
        // Check if REX.B bit used for base register
        if (s.BaseReg)  RexBits &= ~1;
        // Check if REX.X bit used for base register with EVEX prefix
        if (s.Prefixes[3] == 0x62 && s.Mod == 3) RexBits &= ~2;

        // Check if VEX.W bit used for some purpose
        if ((s.OpcodeDef->AllowedPrefixes & 0x7000) != 0 && (s.Prefixes[7] & 0xB0)) RexBits &= ~8;

        // Any unused bits left?
        if (RexBits) {
            s.Warnings1 |= 0x400; // At least one REX bit makes no sense here
        }
    }
    // Check for registers not allowed in 32-bit mode
    if (this->WordSize < 64) {
        if (s.Prefixes[7] & 7 & ~RexBits) {
            s.Errors |= 0x200;        // Register 8-15 not allowed in this mode
        }
        if (s.Prefixes[7] & 0xB0) {
            // VEX present, check vvvv register operand
            if (s.Vreg & 8) s.Errors |= 0x200;  // Register 8-15 not allowed in this mode
            // Check imm[7:4] register operand
            if ((s.OpcodeDef->InstructionFormat & 0x1E) == 0x1C && (Get<uint8>(s.ImmediateField) & 8)) {
                s.Errors |= 0x200;  // Register 8-15 not allowed in this mode
            }
        }
    }

    // Check for meaningless VEX prefix bits
    if (s.Prefixes[7] & 0xB0) {
        // VEX present
        if ((s.Prefixes[6] & 0x60) == 0x20) { // VEX.L bit set and not EVEX
            if (!(s.OpcodeDef->AllowedPrefixes & 0x240000)) s.Warnings1 |= 0x40000000; // L bit not allowed
            if ((s.OpcodeDef->AllowedPrefixes & 0x200000) && s.Prefixes[5] > 0x66) s.Warnings1 |= 0x40000000; // L bit not allowed with F2 and F3 prefix
        }
        else {
            if ((s.OpcodeDef->AllowedPrefixes & 0x100000) && !(s.Prefixes[6] & 0x20)) s.Warnings1 |= 0x1000; // L bit missing
        }
        if ((s.Prefixes[6] & 0x10) && s.Prefixes[3] != 0x62) {
            s.Warnings1 |= 0x40000000; // Uppermost m bit only allowed if EVEX prefix
        }
        // check VEX.v bits
        if (s.Prefixes[3] == 0x62 && s.OpcodeDef->InstructionFormat == 0x1E) {
            // has EVEX VSIB address
            if (s.Vreg & 0xF) {
                s.Warnings1 |= 0x40000000; // vvvv bits not allowed, v' bit allowed
            }
        }
        else { // not EVEX VSIB
            if ((s.Vreg & 0x1F) && !(s.OpcodeDef->AllowedPrefixes & 0x80000)) {
                s.Warnings1 |= 0x40000000; // vvvvv bits not allowed
            }
        }
    }
    // Check for meaningless EVEX and MVEX prefix bits
    if (s.Prefixes[3] == 0x62) {
        if (s.Prefixes[6] & 0x20) {
            // EVEX prefix
            if (s.Mod == 3) {
                // register operands 
                if (!(s.OpcodeDef->EVEX & 6) && (s.Esss & 1)) {
                    s.Warnings2 |= 0x40; // rounding and sae not allowed
                }
            }
            else {
                // memory operand
                if (!(s.OpcodeDef->EVEX & 1) && (s.Esss & 1)) {
                    s.Warnings2 |= 0x40; // broadcast not allowed
                }
            }
            if (!(s.OpcodeDef->EVEX & 0x30) && s.Kreg) {
                s.Warnings2 |= 0x40; // masking not allowed
            }
            else if (!(s.OpcodeDef->EVEX & 0x20) && (s.Esss & 8)) {
                s.Warnings2 |= 0x40; // zeroing not allowed
            }
            else if ((s.OpcodeDef->EVEX & 0x40) && s.Kreg == 0) {
                s.Warnings2 |= 0x100; // mask register must be nonzero
            }
        }
        else {
            // MVEX prefix.
            if (s.Mod == 3) {
                // register operands only
                if ((s.Esss & 8) && (s.OpcodeDef->MVEX & 0x600) == 0) {
                    s.Warnings2 |= 0x80; // E bit not allowed for register operand here
                }
            }
            if (((s.OpcodeDef->MVEX & 0x1F) == 0) && (s.Esss & 7) != 0) {
                s.Warnings2 |= 0x80; // sss bits not allowed here
            }
            if (s.Kreg && (s.OpcodeDef->MVEX & 0x3000) == 0) {
                s.Warnings2 |= 0x80; // kkk bits not allowed here
            }
        }
    }

    // Check for conflicting prefixes
    if (s.OpcodeDef->AllowedPrefixes & 0x140)  s.Conflicts[5] = 0; // 66 + F2/F3 allowed for string instructions
    if ((s.OpcodeDef->AllowedPrefixes & 0x1200) == 0x1200) s.Conflicts[4] = 0; // 66 + REX.W allowed for e.g. movd/movq instruction
    if (*(int64*)&s.Conflicts) s.Warnings1 |= 0x800;  // Conflicting prefixes. Check all categories at once

    // Check for missing prefixes
    if ((s.OpcodeDef->AllowedPrefixes & 0x8000) && s.Prefixes[5] == 0) 
        s.Warnings1 |= 0x1000; // Required 66/F2/F3 prefix missing
    if ((s.OpcodeDef->AllowedPrefixes & 0x20000) && (s.Prefixes[7] & 0xB0) == 0) 
        s.Warnings1 |= 0x1000; // Required VEX prefix missing

    // Check for VEX prefix not allowed
    if (!(s.OpcodeDef->AllowedPrefixes & 0xC30000) && (s.Prefixes[7] & 0xB0)) 
        s.Warnings1 |= 0x40000000; // VEX prefix not allowed

    // Check for EVEX and MVEX prefix allowed
    if (s.Prefixes[3] == 0x62) {

        if (s.Prefixes[6] & 0x20) {
            if (!(s.OpcodeDef->AllowedPrefixes & 0x800000)) s.Warnings2 |= 0x10;
        }
        else {
            if (!(s.OpcodeDef->AllowedPrefixes & 0x400000)) s.Warnings2 |= 0x20;
        }
    }

    // Check for unused SIB scale factor
    if (s.Scale && s.IndexReg == 0) s.Warnings1 |= 0x2000; // SIB has scale factor but no index register

    // Check if address in 64 bit mode is rip-relative
    if (WordSize == 64 && s.AddressFieldSize >= 4 && s.AddressRelocation && !(s.MFlags & 0x100)) {
        // 32-bit address in 64 bit mode is not rip-relative. Check if image-relative
        if (s.AddressRelocation >= Relocations.GetNumEntries() || !(Relocations[s.AddressRelocation].Type & 0x14)) {
            // Not image-relative or relative to reference point
            if (s.AddressFieldSize == 8) {
                s.Warnings1 |= 0x20000000;            // Full 64-bit address
            }
            else {
                s.Warnings1 |= 0x4000;             // 32-bit absolute address
            }
        }
    }
    // Check if direct address is relocated
    if (s.AddressFieldSize > 1 && !s.AddressRelocation && !s.BaseReg && !s.IndexReg && (WordSize != 16 || !(s.Prefixes[0] & 0x40))) 
        s.Warnings1 |= 0x8000;  // Direct address has no relocation, except FS: and GS:

    // Check if address relocation type is correct
    if (s.AddressFieldSize > 1 && s.AddressRelocation && (s.MFlags & 1)) {
        // Memory operand found. Should it be direct or self-relative
        if (s.MFlags & 0x100) {
            // Memory address should be self-relative (rip-relative)
            if (!(Relocations[s.AddressRelocation].Type & 2)) {
                s.Warnings1 |= 0x10000;     // rip-relative relocation expected but not found
            }
        }
        else {
            // Memory address should be direct
            if (Relocations[s.AddressRelocation].Type & 0x302) {
                s.Warnings1 |= 0x10000;     // direct address expected, other type found
            }
        }

        // Check if memory address has correct alignment
        // Loop through destination and source operands
        for (i = 0; i < s.MaxNumOperands; i++) {
            // Operand type
            uint32 OperandType = s.Operands[i];
            if ((OperandType & 0x2000) && Opcodei != 0x8D) {
                // This is a memory operand (except LEA). Get target offset
                int64 TargetOffset = 0;
                switch (s.AddressFieldSize) {
                case 1:
                    TargetOffset = Get<int8>(s.AddressField);  break;
                case 2:
                    TargetOffset = Get<int16>(s.AddressField);  break;
                case 4:
                    TargetOffset = Get<int32>(s.AddressField); 
                    if (s.MFlags & 0x100) {
                        // Compute rip-relative address
                        TargetOffset += IEnd - s.AddressField;
                    }
                    break;
                case 8:
                    TargetOffset = Get<int64>(s.AddressField);  break;
                }
                // Add relocation offset
                TargetOffset += Relocations[s.AddressRelocation].Addend;

                // Find relocation target
                uint32 SymbolOldIndex = Relocations[s.AddressRelocation].TargetOldIndex;
                uint32 SymbolNewIndex = Symbols.Old2NewIndex(SymbolOldIndex);
                if (SymbolNewIndex) {
                    // Add relocation target offset
                    TargetOffset += Symbols[SymbolNewIndex].Offset;
                    // Target section
                    int32 TargetSection = Symbols[SymbolNewIndex].Section;
                    if (TargetSection && (uint32)TargetSection < Sections.GetNumEntries()) {
                        // Add relocation section address
                        TargetOffset += Sections[TargetSection].SectionAddress;
                    }
                    if ((Relocations[s.AddressRelocation].Type & 0x10) && Relocations[s.AddressRelocation].RefOldIndex) {
                        // Add offset of reference point
                        uint32 RefIndex = Symbols.Old2NewIndex(Relocations[s.AddressRelocation].RefOldIndex);
                        TargetOffset += Symbols[RefIndex].Offset;
                    }
                    if (Relocations[s.AddressRelocation].Type & 0x3000) {
                        // GOT entry etc. Can't check alignment
                        continue;
                    }
                }

                // Get operand size
                OperandSize = GetDataItemSize(OperandType);
                if (s.OffsetMultiplier) OperandSize = s.OffsetMultiplier; 
                while (OperandSize & (OperandSize-1)) {
                    // Not a power of 2. Get nearest lower power of 2
                    OperandSize = OperandSize & (OperandSize-1);
                }

                // Check if aligned
                if ((TargetOffset & (OperandSize-1)) && !(s.Warnings1 & 0x10000)) {
                    // Memory operand is misaligned
                    if (s.OffsetMultiplier) {
                        // EVEX code with required alignment
                        s.Warnings1 |= 0x800000;           // Serious. Generates fault
                    }
                    else if (OperandSize < 16) {
                        // Performance penalty but no fault
                        s.Warnings1 |= 0x400000;           // Warn not aligned
                    }
                    else {
                        // XMM or larger. May generate fault
                        // with VEX: only explicitly aligned instructions generate fault
                        // without VEX: all require alignment except explicitly unaligned
                        if (s.OpcodeDef->Options & 0x100 || (!(s.Prefixes[7] & 0xB0) && !(s.OpcodeDef->Options & 0x200))) {
                            s.Warnings1 |= 0x800000;       // Serious. Generates fault
                        }
                        else {
                            s.Warnings1 |= 0x400000;       // Not serious. Performance penalty only
                        }
                    }
                }
            }
        }
    }

    // Check if jump relocation type is correct
    if (s.ImmediateFieldSize > 1 && s.ImmediateRelocation && (s.OpcodeDef->Destination & 0xFE) == 0x82) {
        // Near jump or call. Relocation must be self-relative
        if (!(Relocations[s.ImmediateRelocation].Type & 2)) {
            s.Warnings1 |= 0x10000;  // Self-relative relocation expected but not found
        }
    }
    // Check operand size for jumps
    if ((s.OpcodeDef->AllowedPrefixes & 0x80) && s.Prefixes[4]) {
        // Jump instruction sensitive to operand size prefix
        if (WordSize == 32) s.Warnings1 |= 0x20000; // Instruction pointer truncated
        if (WordSize == 64) s.Warnings1 |= 0x400;   // Prefix has no effect
    }

    // Check address size for stack operations
    if ((s.OpcodeDef->AllowedPrefixes & 2) && s.Prefixes[1]) 
        s.Warnings1 |= 0x40000; // Stack operation has address size prefix

    // Check for undocumented opcode
    if ((s.OpcodeDef->InstructionFormat & 0x4000) && s.OpcodeDef->Name)
        s.Warnings1 |= 0x100000; // Undocumented opcode

    // Check for future opcode
    if (s.OpcodeDef->InstructionFormat & 0x2000)
        s.Warnings1 |= 0x200000; // Opcode reserved for future extensions

    // Check instruction set
    if (s.OpcodeDef->InstructionSet & 0x10000) 
        s.Warnings2 |= 0x2; // Planned future instruction

    if (s.OpcodeDef->InstructionSet & 0x20000) 
        s.Warnings2 |= 0x4; // Proposed instruction code never implemented, preliminary specification later changed

    // Check operand size for stack operations
    if ((s.OpcodeDef->AllowedPrefixes & 0x102) == 0x102) {
        if (s.Prefixes[4] == 0x66 || (Get<uint8>(s.OpcodeStart1) == 0xCF && s.OperandSize != WordSize)) {
            s.Warnings1 |= 0x4000000; // Non-default size for stack operation
        }
    }

    // Check if function ends with ret or unconditional jump (or nop)
    if (IEnd == FunctionEnd && !(s.OpcodeDef->Options & 0x50)) {
        s.Warnings1 |= 0x8000000; // Function does not end with return or jump
    }

    // Check for multi-byte NOP and UD2
    if (s.OpcodeDef->Options & 0x50) CheckForNops();

    // Check for inaccessible code
    if (IBegin == LabelInaccessible) {
        s.Warnings1 |= 0x10000000; // Inaccessible code other than NOP or UD2
    }
}


void CDisassembler::FindErrors() {
    // Find any errors in code
    if (IEnd - IBegin > 15) {
        // Instruction longer than 15 bytes
        s.Errors |= 1;
    }
    if (s.Prefixes[2] && (!(s.OpcodeDef->AllowedPrefixes & 0x10) || !(s.MFlags & 1))) {
        // Lock prefix not allowed for this instruction
        s.Errors |= 2;
    }
    if ( s.OpcodeDef->InstructionFormat == 0 
        || ((s.OpcodeDef->InstructionFormat & 0x4000) && s.OpcodeDef->Name == 0)) {
            // Illegal instruction
            s.Errors |= 4;
    }
    if ((s.OpcodeDef->InstructionSet & 0x8000) && WordSize == 64) {
        // Instruction not allowed in 64 bit mode
        s.Errors |= 0x40;
    }
    if (IEnd > LabelEnd && IBegin < LabelEnd) {
        // Instruction crosses a label
        // Check if label is public
        uint32 sym1 = Symbols.FindByAddress(Section, LabelEnd, 0, 0);
        if (sym1 && (Symbols[sym1].Scope & 0x1C)) {
            // Label is public. Code interpretation may be out of phase
            s.Errors |= 0x80;
            // Put interpretation in phase with label
            IEnd = LabelEnd;
        }
        else {
            // Symbol is local. 
            // This may be a spurious label produced by misinterpretation elsewhere
            if (sym1) Symbols[sym1].Type = 0;       // Remove symbol type
            s.Warnings2 |= 1;
        }
    }
    if ((s.MFlags & 3) == 3 && (s.Prefixes[7] & 1) && s.BaseReg == 0 && s.AddressFieldSize == 4) {
        // Attempt to use R13 as base register without displacement
        s.Errors |= 0x100;
    }
    if ((s.OpcodeDef->InstructionFormat & 0x1E) == 0x14) {
        // Check validity of DREX byte
        if ((s.Vreg & 0x87) && WordSize < 64) {
            s.Errors |= 0x200;  // Attempt to use XMM8-15 in 16 or 32 bit mode (ignored, may be changed to warning)
        }
        if (s.Prefixes[7] & 0x40) {
            s.Errors |= 0x400;  // Both REX and DREX byte
        }
        if ((s.Vreg & 2) && !(s.MFlags & 4)) {
            s.Errors |= 0x800;  // DREX.X bit but no SIB byte (probably ignored, may be changed to warning)
        }
    }
    if ((s.OpcodeDef->InstructionFormat & 0x1F) == 0x1E) {
        // Instruction needs VSIB byte
        if (s.IndexReg == 0) s.Errors |= 8;  // Illegal operand: no index register
    }
    if (LabelEnd >= s.OpcodeStart2+2 && (
        Get<uint16>(s.OpcodeStart2) == 0 
        || Get<uint16>(s.OpcodeStart2) == 0xFFFF
        // || Get<uint16>(s.OpcodeStart2) == 0xCCCC
        )) {
            // Two consecutive bytes of zero gives the instruction: add byte ptr [eax],al
            // This instruction is very unlikely to occur in normal code but occurs
            // frequently in data. Mark to code as probably data.
            // Two bytes of 0xFF makes no legal instruction but occurs frequently in data.
            // Two bytes of 0xCC is debug breaks used by debuggers for marking illegal addresses or unitialized data
            s.Errors = 0x4000;
    }
    if (s.Errors) {
        // Errors found. May be data in code segment
        CountErrors++;
        MarkCodeAsDubious();
    }
}


void CDisassembler::FindRelocations() {
    // Find any relocation sources in this instruction
    SARelocation rel1, rel2;                      // Make relocation records for searching
    rel1.Section = Section;
    rel1.Offset  = IBegin;                        // rel1 marks begin of this instruction
    rel2.Section = Section;
    rel2.Offset  = IEnd;                          // rel2 marks end of this instruction

    // Search for relocations in this instruction
    uint32 irel = Relocations.FindFirst(rel1);    // Finds first relocation source >= IBegin

    if (irel == 0 || irel >= Relocations.GetNumEntries()) {
        // No relocations found
        return;
    }
    if (Relocations[irel] < rel2) {
        // Found relocation points between IBegin and IEnd
        if (Relocations[irel].Offset == s.AddressField && s.AddressFieldSize) {
            // Relocation points to address field
            s.AddressRelocation = irel;
            if (Relocations[irel].Size > s.AddressFieldSize) {
                // Right place but wrong size
                s.Errors |= 0x1000;
            }
        }
        else if (Relocations[irel].Offset == s.ImmediateField && s.ImmediateFieldSize) {
            // Relocation points to immediate operand/jump address field
            s.ImmediateRelocation = irel;
            if (Relocations[irel].Size > s.ImmediateFieldSize) {
                // Right place but wrong size
                s.Errors |= 0x1000;
            }
        }
        else {
            // Relocation source points to a wrong address
            s.Errors |= 0x1000;
        }
        if (s.AddressRelocation) {
            // Found relocation for address field, there may be
            // a second relocation for the immediate field
            if (irel + 1 < Relocations.GetNumEntries() && Relocations[irel+1] < rel2) {
                // Second relocation found
                if (Relocations[irel+1].Offset == s.ImmediateField && s.ImmediateFieldSize) {
                    // Relocation points to immediate operand/jump address field
                    s.ImmediateRelocation = irel + 1;
                    if (Relocations[irel+1].Size > s.ImmediateFieldSize) {
                        // Right place but wrong size
                        s.Errors |= 0x1000;
                    }
                    else {
                        // Second relocation accepted
                        irel++;
                    }
                }
            }
        }
        // Check if there are more relocations
        if (irel + 1 < Relocations.GetNumEntries() && Relocations[irel+1] < rel2) {
            // This relocation points before IEnd but doesn't fit any operand or overlaps previous relocation
            if ((s.Operands[0] & 0xFE) == 0x84 && Relocations[irel+1].Offset == s.ImmediateField + s.ImmediateFieldSize - 2) {
                // Fits segment field of far jump/call
                ;
            }
            else {
                // Relocation doesn't fit anywhere
                s.Errors |= 0x1000;
            }
        }
    }
}


void CDisassembler::FindInstructionSet() {
    // Update instruction set
    uint16 InstSet = s.OpcodeDef->InstructionSet;
    if (InstSet == 7 && s.Prefixes[5] == 0x66) {
        // Change MMX to SSE2 if 66 prefix
        InstSet = 0x12;
    }
    if ((s.Prefixes[7] & 0x30) && InstSet < 0x19) {
        // VEX instruction set if VEX prefix
        InstSet = 0x19;
    }
    if (s.Prefixes[6] & 0x40) {
        // EVEX or MVEX prefix
        if (s.Prefixes[6] & 0x20) {
            // EVEX prefix
            if (InstSet < 0x20) InstSet = 0x20;
        }
        else {
            // MVEX prefix
            if (InstSet < 0x80) InstSet = 0x80;
        }
    }
    if ((InstSet & 0xFF00) == 0x1000) {
        // AMD-specific instruction set
        // Set AMD-specific instruction set to max
        if ((InstSet & 0xFF) > InstructionSetAMDMAX) {
            InstructionSetAMDMAX = InstSet & 0xFF;
        }
    }
    else {
        // Set Intel or generic instruction set to maximum
        if ((InstSet & 0xFF) > InstructionSetMax) {
            InstructionSetMax = InstSet & 0xFF;
        }
    }

    // Set InstructionSetOR to a bitwise OR of all instruction sets encountered
    InstructionSetOR |= InstSet;

    if (s.OpcodeDef->Options & 0x10) {
        FlagPrevious |= 2;
    }
}


void CDisassembler::CheckLabel() {
    // Check if there is a label at instruction, and write it
    // Write begin and end of function

    // Search in symbol table
    uint32 Sym1, Sym2;                            // First and last symbol

    // Find all symbol table entries at this address
    Sym1 = Symbols.FindByAddress(Section, IBegin, &Sym2);

    if (Sym1) {
        // Found at least one symbol
        // Loop for all symbols with same address
        for (uint32 s = Sym1; s <= Sym2; s++) {

            // Check if label has already been written as a function label
            if (!(Symbols[s].Scope & 0x100) && !(Symbols[s].Type & 0x80000000)) {

                // Write label as a private or public code label
                WriteCodeLabel(s);
            }
        }
        // Get symbol type and size
        DataType = Symbols[Sym2].Type;
        DataSize = GetDataItemSize(DataType);
    }
}


void CDisassembler::CheckForNops() {
    // Check for multi-byte NOP and UD2 instructions

    switch (Opcodei) {
    case 0x3C00: case 0x3C01: case 0x3C02: case 0x11F:  // NOP      
        // These opcodes are intended for NOPs. Indicate if longer than one byte
        if (IEnd - IBegin > 1) s.Warnings1 |= 0x1000000;
        // Remember NOP
        FlagPrevious |= 1;
        break;

    case 0x8D:   // LEA
        // LEA is often used as NOP with destination = base register
        if (s.Mod < 3 && s.Reg+1 == s.BaseReg && s.IndexReg == 0 && 
            s.AddressSize == s.OperandSize && s.OperandSize >= WordSize) {
                // Destination is same as base register. 
                // Check if displacement is 0
                switch (s.AddressFieldSize) {
    case 0:
        break;
    case 1:
        if (Get<int8>(s.AddressField) != 0) return;
        break;
    case 2:
        if (Get<int16>(s.AddressField) != 0) return;
        break;
    case 4:
        if (Get<int32>(s.AddressField) != 0) return;
        break;
    default:
        return;
                }
                // Displacement is zero. This is a multi-byte NOP
                s.Warnings1 |= 0x1000000;
                break;
        }

    case 0x86: case 0x87:  // XCHG
    case 0x88: case 0x89: case 0x8A: case 0x8B:  // MOV
        // Check if source and destination are the same register
        if (s.Mod == 3 && s.Reg == s.RM && s.OperandSize >= WordSize) {
            // Moving a register to itself. This is a NOP
            s.Warnings1 |= 0x1000000;
        }
        break;
    case 0x10B:  // UD2
        FlagPrevious |= 6;
        break;
    }

    if (s.Warnings1 & 0x1000000) {
        // A multi-byte NOP is detected. 
        // Remove warnings for longer-than-necessary instruction
        s.Warnings1 &= ~ 0x873D;
        // Remember NOP
        FlagPrevious |= 1;
    }
}


void CDisassembler::InitialErrorCheck() {
    // Check for illegal relocations table entries
    uint32 i;                                     // Loop counter

    // Loop through relocations table
    for (i = 1; i < Relocations.GetNumEntries(); i++) {
        if (Relocations[i].TargetOldIndex >= Symbols.GetLimit()) {
            // Nonexisting relocation target
            Relocations[i].TargetOldIndex = 0;
        }
        if (Relocations[i].RefOldIndex >= Symbols.GetLimit()) {
            // Nonexisting reference index
            Relocations[i].RefOldIndex = 0;
        }
        // Remember types of relocations in source
        RelocationsInSource |= Relocations[i].Type;
    }

    // Check opcode tables
    if (NumOpcodeTables1 != NumOpcodeTables2) {
        err.submit(9007, 0xFFFF);
    }
}


void CDisassembler::FinalErrorCheck() {
    // Check for illegal entries in symbol table and relocations table
    uint32 i;                                     // Loop counter
    int SpaceWritten = 0;                         // Blank line written

    // Loop through symbol table
    for (i = 1; i < Symbols.GetNumEntries(); i++) {
        if (Symbols[i].Section <= 0 || (Symbols[i].Type & 0x80000000)) {
            // Constant or external symbol or section
            continue;
        }
        if ((uint32)Symbols[i].Section >= Sections.GetNumEntries()
            || Symbols[i].Offset > Sections[Symbols[i].Section].TotalSize) {
                // Symbol has illegal address
                // Blank line
                if (!SpaceWritten++) OutFile.NewLine();
                // Write comment
                OutFile.Put(CommentSeparator);
                OutFile.Put("Error: Symbol ");
                // Write symbol name
                OutFile.Put(Symbols.GetName(i));
                // Write the illegal address
                OutFile.Put(" has a non-existing address. Section: ");
                if (Symbols[i].Section != ASM_SEGMENT_IMGREL) {
                    OutFile.PutDecimal(Symbols[i].Section, 1);
                }
                else {
                    OutFile.Put("Unknown");
                }
                OutFile.Put(" Offset: ");
                OutFile.PutHex(Symbols[i].Offset, 1);
                OutFile.NewLine();
        }
    }
    // Loop through relocations table
    for (i = 1; i < Relocations.GetNumEntries(); i++) {
        // Check source address
        if (Relocations[i].Section == 0 
            || (uint32)Relocations[i].Section >= Sections.GetNumEntries()
            || (Sections[Relocations[i].Section].Type & 0xFF) == 3
            || Relocations[i].Offset >= Sections[Relocations[i].Section].InitSize) {
                // Relocation has illegal source address
                // Blank line
                if (!SpaceWritten++) OutFile.NewLine();
                // Write comment
                OutFile.Put(CommentSeparator);
                OutFile.Put("Error: Relocation number ");
                OutFile.PutDecimal(i);
                OutFile.Put(" has a non-existing source address. Section: ");
                if (Relocations[i].Section != ASM_SEGMENT_IMGREL) {
                    OutFile.PutDecimal(Relocations[i].Section, 1);
                }
                else {
                    OutFile.Put("Unknown");
                }
                OutFile.Put(" Offset: ");
                OutFile.PutHex(Relocations[i].Offset, 1);
                OutFile.NewLine();
        }
        // Check target
        if (Relocations[i].TargetOldIndex == 0 
            || Relocations[i].TargetOldIndex >= Symbols.GetLimit()
            || Relocations[i].RefOldIndex >= Symbols.GetLimit()) {
                // Relocation has illegal target
                // Blank line
                if (!SpaceWritten++) OutFile.NewLine();
                // Write comment
                OutFile.Put(CommentSeparator);
                OutFile.Put("Error: Relocation number ");
                OutFile.PutDecimal(i);
                OutFile.Put(" at section ");
                OutFile.PutDecimal(Relocations[i].Section);
                OutFile.Put(" offset ");
                OutFile.PutHex(Relocations[i].Offset);
                OutFile.Put(" has a non-existing target index. Target: ");
                OutFile.PutDecimal(Relocations[i].TargetOldIndex, 1);
                if (Relocations[i].RefOldIndex) {
                    OutFile.Put(", Reference point index: ");
                    OutFile.PutDecimal(Relocations[i].RefOldIndex, 1);
                }
                OutFile.NewLine();
        }
    }
}


void CDisassembler::CheckNamesValid() {
    // Fix invalid symbol and section names
    uint32 i, j;                                  // Loop counter
    uint32 Len;                                   // Length of name
    uint32 Changed;                               // Symbol is changed
    char c;                                       // Character in symbol
    const char * ValidCharacters;                 // List of valid characters in symbol names
    // Make list of characters valid in symbol names other than alphanumeric characters
    switch (Syntax) {
    case SUBTYPE_MASM:
        ValidCharacters = "_$@?";  break;
    case SUBTYPE_YASM:
        ValidCharacters = "_$@?.~#";  break;
    case SUBTYPE_GASM:
        ValidCharacters = "_$.";  break;
    default:
        err.submit(9000);
    }

    // Loop through sections
    for (i = 1; i < Sections.GetNumEntries(); i++) {
        char * SecName = NameBuffer.Buf() + Sections[i].Name;
        if (Syntax == SUBTYPE_MASM && SecName[0] == '.') {
            // Name begins with dot
            // Check for reserved names
            if (stricmp(SecName, ".text") == 0
                ||  stricmp(SecName, ".data") == 0
                ||  stricmp(SecName, ".code") == 0
                ||  stricmp(SecName, ".const") == 0) {
                    // Change . to _ in beginning of name to avoid reserved directive name
                    SecName[0] = '_'; 
            }
            else {
                // Other name beginning with .
                // Set option dotname
                MasmOptions |= 1;
            }
        }
    }
    // Loop through symbols
    for (i = 1; i < Symbols.GetNumEntries(); i++) {
        if (Symbols[i].Name) {
            // Warning: violating const specifier in GetName():
            char * SymName = (char *)Symbols.GetName(i);  
            Len = strlen(SymName);  Changed = 0;
            // Loop through characters in symbol
            for (j = 0; j < Len; j++) {
                c = SymName[j];
                if (!(((c | 0x20) >= 'a' && (c | 0x20) <= 'z')
                || (c >= '0' && c <= '9' && j != 0)
                || strchr(ValidCharacters, c))) {
                    // Illegal character found
                    if (Syntax == SUBTYPE_MASM) {
                        if (j == 0 && c == '.') {
                            // Symbol beginning with dot in MASM
                            if (Symbols[i].Type & 0x80000000) {
                                // This is a segment. Check for reserved names
                                if (stricmp(SymName, ".text") == 0
                                    ||  stricmp(SymName, ".data") == 0
                                    ||  stricmp(SymName, ".code") == 0
                                    ||  stricmp(SymName, ".const") == 0) {
                                        // Change . to _ in beginning of name to avoid reserved directive name
                                        SymName[0] = '_';  // Warning: violating const specifier in GetName()
                                        break; // break out of j loop
                                }
                            }         
                            // Set option dotname
                            MasmOptions |= 1;
                        }
                        else {
                            // Other illegal character in MASM
#if ReplaceIllegalChars
                            SymName[j] = '?'; 
#endif
                            Changed++;
                        }
                    }
                    else {
                        // Illegal character in GAS or YASM syntax
#if ReplaceIllegalChars
                        SymName[j] = (Syntax == SUBTYPE_YASM) ? '?' : '$';
#endif
                        Changed++;
                    }
                }
            }
            // Count names changed
            if (Changed) NamesChanged++;
        }
    }
}


void CDisassembler::FixRelocationTargetAddresses() {
    // Fix missing relocation target addresses
    // to section:offset addresses
    uint32 r;                                     // Relocation index
    uint32 s;                                     // Symbol index
    int32 sect;

    // Loop through relocations
    for (r = 1; r < Relocations.GetNumEntries(); r++) {

        if (Relocations[r].TargetOldIndex == 0 && (Relocations[r].Type & 0x60)) {
            // Target symbol not defined. Make new symbol
            SASymbol sym;
            sym.Reset();

            // Find target address from relocation source
            sect = Relocations[r].Section;
            if ((uint32)sect >= Sections.GetNumEntries()) continue;
            uint8 * pSectionData = Sections[sect].Start;
            if (!pSectionData) continue;
            int64 TargetOffset = 0;
            if (Relocations[r].Size == 4) {
                TargetOffset = *(int32*)(pSectionData + Relocations[r].Offset);
            }
            else if (Relocations[r].Size == 8) {
                TargetOffset = *(int64*)(pSectionData + Relocations[r].Offset);
            }
            else {
                // Error: wrong size
                continue;
            }
            if (HighDWord(TargetOffset)) {
                // Error: out of range
                continue;
            }
            // Translate to section:offset address
            if (!(TranslateAbsAddress(TargetOffset, sym.Section, sym.Offset))) {
                // Translation failed
                continue;
            }
            // Default scope is file local
            sym.Scope = 2;

            // Add symbol if it doesn't exist or get index of existing symbol
            s = Symbols.NewSymbol(sym);

            // Make reference to symbol from relocation record
            if (s) {
                Relocations[r].TargetOldIndex = Symbols[s].OldIndex;
            }
        }
    }
}


int CDisassembler::TranslateAbsAddress(int64 Addr, int32 &Sect, uint32 &Offset) {
    // Translate absolute virtual address to section and offset
    // Returns 1 if valid address found.
    int32 Section;

    // Get image-relative address
    Addr -= ImageBase;
    // Fail if too big
    if (HighDWord(Addr)) return 0;

    // Search through sections
    for (Section = 1; (uint32)Section < Sections.GetNumEntries(); Section++) {
        uint32 SectionAddress = Sections[Section].SectionAddress;
        if ((uint32)Addr >= SectionAddress && (uint32)Addr < SectionAddress + Sections[Section].TotalSize) {
            // Address is within this section
            // Return section and offset
            Sect = Section;
            Offset = (uint32)Addr - SectionAddress;
            // Return 1 to indicate success
            return 1;
        }
    }
    // Not found. Return 0
    return 0;
}


uint32 CDisassembler::GetDataItemSize(uint32 Type) {
    // Get size in bytes of data item with specified type
    uint32 Size = 1;

    switch (Type & 0xFF) {
        // Scalar types
    case 1:
        Size = 1;  break;
    case 2: case 0x4A: case 0x95:
        Size = 2;  break;
    case 3: case 0x43: case 0x4B:
        Size = 4;  break;
    case 4: case 0x44: case 0x4C:
        Size = 8;  break;
    case 5: case 0x45:
        Size = 10;  break;
    case 7:
        Size = 6;  break;
    case 0x50: case 51:
        Size = 16;  break;
    case 0x0B: case 0x0C:
        // Function pointer
        Size = WordSize / 8;  break;
    case 0x0D:
        // Far function pointer
        Size = WordSize / 8 + 2;  break;
    }
    switch (Type & 0xF00) {
    // Override above size if vector of known size
    case 0x300:
        Size = 8;  break;
    case 0x400:
        Size = 16;  break;
    case 0x500:
        Size = 32;  break;
    case 0x600:
        Size = 64;  break;
    case 0x700:
        Size = 128;  break;
    }
    return Size;
}


uint32 CDisassembler::GetDataElementSize(uint32 Type) {
    // Get size of vector element in data item with specified type
    if ((Type & 0xF0) == 0x50) {
        // Vector of unknown elements
        return GetDataItemSize(Type);
    }
    else {
        // Vector of known elements. Return element type
        return GetDataItemSize(Type & 7);
    }
}


int32 CDisassembler::GetSegmentRegisterFromPrefix() {
    // Translate segment prefix to segment register
    switch (s.Prefixes[0]) {
    case 0x26:  // ES:
        return 0;
    case 0x2E:  // CS:
        return 1;
    case 0x36:  // SS:
        return 2;
    case 0x3E:  // DS:
        return 3;
    case 0x64:  // FS:
        return 4;
    case 0x65:  // GS:
        return 5;
    }
    return -1;  // Error: none
}