The MAL layer is the interface to the kernel. It contains a large collection of C-functions geared at a specific relational operator. Furthermore, it contains routines for inspection of the interpreter and debugging.
For more details on a command/pattern use the following SQL query:
SELECT * FROM sys.malfunctions() WHERE module= 'modulename' AND function = 'functionname'.