===================
String operators #1
===================

rule rule123 {
    condition:
        "abc" contains "a" or "ABC" icontains "b"
}

---

(yara_file
    (rule
        (rule_head
            (identifier)
        )
        (rule_body
            (or
                (contains
                    (string_literal
                        (string_literal_str)
                    )
                    (string_literal
                        (string_literal_str)
                    )
                )
                (icontains
                    (string_literal
                        (string_literal_str)
                    )
                    (string_literal
                        (string_literal_str)
                    )
                )
            )
        )
    )
)


===================
String operators #2
===================

rule rule123 {
    condition:
        "abc" startswith "a" and "ABC" istartswith "b"
}

---

(yara_file
    (rule
        (rule_head
            (identifier)
        )
        (rule_body
            (and
                (startswith
                    (string_literal
                        (string_literal_str)
                    )
                    (string_literal
                        (string_literal_str)
                    )
                )
                (istartswith
                    (string_literal
                        (string_literal_str)
                    )
                    (string_literal
                        (string_literal_str)
                    )
                )
            )
        )
    )
)


===================
String operators #3
===================

rule rule123 {
    condition:
        "abc" endswith "a" and "ABC" iendswith "b"
}

---

(yara_file
    (rule
        (rule_head
            (identifier)
        )
        (rule_body
            (and
                (endswith
                    (string_literal
                        (string_literal_str)
                    )
                    (string_literal
                        (string_literal_str)
                    )
                )
                (iendswith
                    (string_literal
                        (string_literal_str)
                    )
                    (string_literal
                        (string_literal_str)
                    )
                )
            )
        )
    )
)


===================
String operators #4
===================

rule rule123 {
    condition:
        "hello" matches /hel+o/ and "Č" iequals "č"
}

---

(yara_file
    (rule
        (rule_head
            (identifier)
        )
        (rule_body
            (and
                (matches
                    (string_literal
                        (string_literal_str)
                    )
                    (regexp
                        (regexp_body
                            (regexp_cat
                                (regexp_cat
                                    (regexp_cat
                                        (regexp_char)
                                        (regexp_char)
                                    )
                                    (regexp_rep
                                        (regexp_char)
                                        (regexp_rep_quantifier)
                                    )
                                )
                                (regexp_char)
                            )
                        )
                    )
                )
                (iequals
                    (string_literal
                        (string_literal_str)
                    )
                    (string_literal
                        (string_literal_str)
                    )
                )
            )
        )
    )
)

