7.2. Memory Addressing

x86's complex addressing modes are captured by MemSpec:

MemSpec.reg EBX : MemSpec#check MemSpec.reg EBX

-- Register + displacement: [EBX + 8]
MemSpec.regDisp EBX 8 : MemSpec#check MemSpec.regDisp EBX 8

-- Absolute address: [0x12345678]
MemSpec.disp 305419896 : MemSpec#check MemSpec.disp 0x12345678

-- Scaled index: [EAX + ECX*4]
MemSpec.regIdx EAX NonSPReg.ECX Scale.S4 : MemSpec#check MemSpec.regIdx EAX (NonSPReg.ECX) Scale.S4

-- Full SIB: [EAX + ECX*4 + 16]
MemSpec.regIdxDisp EAX NonSPReg.ECX Scale.S4 16 : MemSpec#check MemSpec.regIdxDisp EAX (NonSPReg.ECX) Scale.S4 16

Scale factors are defined by Scale:

Scale.S1 - multiply by 1 (no scaling)
Scale.S2 - multiply by 2
Scale.S4 - multiply by 4 (common for 32-bit arrays)
Scale.S8 - multiply by 8 (common for 64-bit arrays)