===================
Integer function #1
===================

rule filesize_test {
    condition:
        int8(10) == 0xFF 
        and int16(100) == 0xEEEE
        and int32(1000) == 0xDDDDDDDD
}

---

(yara_file
    (rule
        (rule_head
            (identifier)
        )
        (rule_body
            (and
                (and
                    (equal
                        (function_call
                            (identifier)
                            (argument_list
                                (uint_literal
                                    (dec_uint_literal_value)
                                )
                            )
                        )
                        (uint_literal
                            (hex_uint_literal_value)
                        )
                    )
                    (equal
                        (function_call
                            (identifier)
                            (argument_list
                                (uint_literal
                                    (dec_uint_literal_value)
                                )
                            )
                        )
                        (uint_literal
                            (hex_uint_literal_value)
                        )
                    )
                )
                (equal
                    (function_call
                        (identifier)
                        (argument_list
                            (uint_literal
                                (dec_uint_literal_value)
                            )
                        )
                    )
                    (uint_literal
                        (hex_uint_literal_value)
                    )
                )
            )
        )
    )
)


===================
Integer function #2
===================

rule filesize_test {
    condition:
        uint32(10) == 0xFF 
        and uint16(100) != 0xEEEE
        and uint8(50) == 0xDDDDDDDD
}

---

(yara_file
    (rule
        (rule_head
            (identifier)
        )
        (rule_body
            (and
                (and
                    (equal
                        (function_call
                            (identifier)
                            (argument_list
                                (uint_literal
                                    (dec_uint_literal_value)
                                )
                            )
                        )
                        (uint_literal
                            (hex_uint_literal_value)
                        )
                    )
                    (not_equal
                        (function_call
                            (identifier)
                            (argument_list
                                (uint_literal
                                    (dec_uint_literal_value)
                                )
                            )
                        )
                        (uint_literal
                            (hex_uint_literal_value)
                        )
                    )
                )
                (equal
                    (function_call
                        (identifier)
                        (argument_list
                            (uint_literal
                                (dec_uint_literal_value)
                            )
                        )
                    )
                    (uint_literal
                        (hex_uint_literal_value)
                    )
                )
            )
        )
    )
)


========================
Integer function #3 (be)
========================

rule filesize_test {
    condition:
        int8be(10) == 0xFF 
        and int16be(100) == 0xEEEE
        and int32be(1000) == 0xDDDDDDDD
}

---

(yara_file
    (rule
        (rule_head
            (identifier)
        )
        (rule_body
            (and
                (and
                    (equal
                        (function_call
                            (identifier)
                            (argument_list
                                (uint_literal
                                    (dec_uint_literal_value)
                                )
                            )
                        )
                        (uint_literal
                        (hex_uint_literal_value)
                        )
                    )
                    (equal
                        (function_call
                            (identifier)
                            (argument_list
                                (uint_literal
                                    (dec_uint_literal_value)
                                )
                            )
                        )
                        (uint_literal
                            (hex_uint_literal_value)
                        )
                    )
                )
                (equal
                    (function_call
                        (identifier)
                        (argument_list
                            (uint_literal
                                (dec_uint_literal_value)
                            )
                        )
                    )
                    (uint_literal
                        (hex_uint_literal_value)
                    )
                )
            )
        )
    )
)


========================
Integer function #4 (be)
========================

rule filesize_test {
    condition:
        uint32be(10) == 0xFF 
        and uint16be(100) != 0xEEEE
        and uint8be(uint32(0x10)) == 0xDDDDDDDD
}

---

(yara_file
    (rule
        (rule_head
            (identifier)
        )
        (rule_body
            (and
                (and
                    (equal
                        (function_call
                            (identifier)
                            (argument_list
                                (uint_literal
                                    (dec_uint_literal_value)
                                )
                            )
                        )
                        (uint_literal
                            (hex_uint_literal_value)
                        )
                    )
                    (not_equal
                        (function_call
                            (identifier)
                            (argument_list
                                (uint_literal
                                    (dec_uint_literal_value)
                                )
                            )
                        )
                        (uint_literal
                            (hex_uint_literal_value)
                        )
                    )
                )
                (equal
                    (function_call
                        (identifier)
                        (argument_list
                            (function_call
                                (identifier)
                                (argument_list
                                    (uint_literal
                                        (hex_uint_literal_value)
                                    )
                                )
                            )
                        )
                    )
                    (uint_literal
                        (hex_uint_literal_value)
                    )
                )
            )
        )
    )
)

