============================== Sample 1 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined akira_widgets_export_widget_get_image_buffer_size_data_free() PUSH RBP MOV RBP,RDI MOV RDI,qword ptr [RDI + 0x20] TEST RDI,RDI JZ LAB_0017763a CALL .plt.got:::g_object_unref ;undefined g_object_unref() MOV qword ptr [RBP + 0x20],0x0 LAB_0017763a: MOV RSI,RBP MOV EDI,0x48 POP RBP JMP .plt:::g_slice_free1 ;undefined g_slice_free1() ?? 0Fh Actual src: static void akira_widgets_export_widget_get_image_buffer_size_data_free (gpointer _data) { AkiraWidgetsExportWidgetGetImageBufferSizeData* _data_; _data_ = _data; _g_object_unref0 (_data_->self); g_slice_free (AkiraWidgetsExportWidgetGetImageBufferSizeData, _data_); } Predicted src: static void on_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_buffer_bufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbufferbuffe ============================== Sample 2 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined xdr_virNetMessageError() PUSH RBP MOV RBP,RDI PUSH RBX MOV RBX,RSI SUB RSP,0x8 CALL .plt.got:::xdr_int ;bool_t xdr_int(XDR * __xdrs, int * _... TEST EAX,EAX JNZ LAB_002d7370 LAB_002d7365: XOR EAX,EAX LAB_002d7367: ADD RSP,0x8 POP RBX POP RBP RET ?? 66h f ?? 90h LAB_002d7370: LEA RSI,[RBX + 0x4] MOV RDI,RBP CALL .plt.got:::xdr_int ;bool_t xdr_int(XDR * __xdrs, int * _... TEST EAX,EAX JZ LAB_002d7365 LEA RSI,[RBX + 0x8] MOV RDI,RBP CALL .plt:xdr_virNetMessageString ;undefined xdr_virNetMessageString() TEST EAX,EAX JZ LAB_002d7365 LEA RSI,[RBX + 0x10] MOV RDI,RBP CALL .plt.got:::xdr_int ;bool_t xdr_int(XDR * __xdrs, int * _... TEST EAX,EAX JZ LAB_002d7365 LEA RSI,[RBX + 0x18] MOV RDI,RBP CALL .plt:xdr_virNetMessageDomain ;undefined xdr_virNetMessageDomain() TEST EAX,EAX JZ LAB_002d7365 LEA RSI,[RBX + 0x20] MOV RDI,RBP CALL .plt:xdr_virNetMessageString ;undefined xdr_virNetMessageString() TEST EAX,EAX JZ LAB_002d7365 LEA RSI,[RBX + 0x28] MOV RDI,RBP CALL .plt:xdr_virNetMessageString ;undefined xdr_virNetMessageString() TEST EAX,EAX JZ LAB_002d7365 LEA RSI,[RBX + 0x30] MOV RDI,RBP CALL .plt:xdr_virNetMessageString ;undefined xdr_virNetMessageString() TEST EAX,EAX JZ LAB_002d7365 LEA RSI,[RBX + 0x38] MOV RDI,RBP CALL .plt.got:::xdr_int ;bool_t xdr_int(XDR * __xdrs, int * _... TEST EAX,EAX JZ LAB_002d7365 LEA RSI,[RBX + 0x3c] MOV RDI,RBP CALL .plt.got:::xdr_int ;bool_t xdr_int(XDR * __xdrs, int * _... TEST EAX,EAX JZ LAB_002d7365 LEA RSI,[RBX + 0x40] MOV RDI,RBP CALL .plt:xdr_virNetMessageNetwork ;undefined xdr_virNetMessageNetwork() TEST EAX,EAX SETNZ AL MOVZX EAX,AL JMP LAB_002d7367 ?? 66h f Actual src: bool_t xdr_virNetMessageError (XDR *xdrs, virNetMessageError *objp) { if (!xdr_int (xdrs, &objp->code)) return FALSE; if (!xdr_int (xdrs, &objp->domain)) return FALSE; if (!xdr_virNetMessageString (xdrs, &objp->message)) return FALSE; if (!xdr_int (xdrs, &objp->level)) return FALSE; if (!xdr_virNetMessageDomain (xdrs, &objp->dom)) return FALSE; if (!xdr_virNetMessageString (xdrs, &objp->str1)) return FALSE; if (!xdr_virNetMessageString (xdrs, &objp->str2)) return FALSE; if (!xdr_virNetMessageString (xdrs, &objp->str3)) return FALSE; if (!xdr_int (xdrs, &objp->int1)) return FALSE; if (!xdr_int (xdrs, &objp->int2)) return FALSE; if (!xdr_virNetMessageNetwork (xdrs, &objp->net)) return FALSE; return TRUE; } Predicted src: static int __pyx_tp_7pyverbs_5py_5_5py_5_5_5_5_5_5_5_555_55555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555555 ============================== Sample 3 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined AICast_TravEntityForName() PUSH R12 PUSH RBP MOV RBP,RSI PUSH RBX TEST RDI,RDI JZ LAB_00126120 LEA RAX,[.bss:g_entities] ;=?? LEA R12,[RDI + 0x670] LAB_001260ae: MOVSXD RBX,dword ptr [.bss:aicast_maxclients] ;=?? IMUL RBX,RBX,0x670 ADD RBX,RAX CMP R12,RBX JNC LAB_0012610c LAB_001260c4: MOV EAX,dword ptr [R12 + 0x2b0] TEST EAX,EAX JZ LAB_00126100 CMP qword ptr [R12 + 0x2a8],0x0 JZ LAB_00126100 MOV RDI,qword ptr [R12 + 0x4d8] TEST RDI,RDI JZ LAB_00126100 MOV RSI,RBP CALL .plt:::strcmp ;int strcmp(char * __s1, char * __s2) TEST EAX,EAX JNZ LAB_00126100 MOV RAX,R12 POP RBX POP RBP POP R12 RET ?? 0Fh ?? 1Fh ?? 40h @ ?? 00h LAB_00126100: ADD R12,0x670 CMP R12,RBX JC LAB_001260c4 LAB_0012610c: XOR R12D,R12D POP RBX POP RBP MOV RAX,R12 POP R12 RET ?? 66h f ?? 0Fh ;? -> 00841f0f ?? 1Fh ?? 84h ?? 00h ?? 00h ?? 00h ?? 00h ?? 00h LAB_00126120: LEA RAX,[.bss:g_entities] ;=?? MOV R12,RAX JMP LAB_001260ae ?? 90h Actual src: gentity_t *AICast_TravEntityForName( gentity_t *startent, char *name ) { gentity_t *trav; if (!startent ) { trav = g_entities; } else { trav = startent + 1; } for ( ; trav < g_entities + aicast_maxclients; trav++ ) { if (!trav->inuse ) { continue; } if (!trav->client ) { continue; } if (!trav->aiName ) { continue; } if ( strcmp( trav->aiName, name ) ) { continue; } return trav; } return NULL; } Predicted src: static int get_list(const void *data, const void *data) { int i; for (i = 0; i < len; i++) if (data[i] == 0) return -1; if (data[i] == 0) return 0; return 0; } ============================== Sample 4 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined stp_parameter_list_param() PUSH RBP MOV RBP,RDI PUSH RBX MOV RBX,RSI SUB RSP,0x8 CALL .plt:stp_list_get_length ;undefined stp_list_get_length() CDQE CMP RAX,RBX JBE LAB_00132548 MOV RDI,RBP MOV ESI,EBX CALL .plt:stp_list_get_item_by_index ;undefined stp_list_get_item_by_index() MOV RDI,RAX TEST RAX,RAX JZ LAB_00132548 ADD RSP,0x8 POP RBX POP RBP JMP .plt:stp_list_item_get_data ;undefined stp_list_item_get_data() ?? 0Fh ?? 1Fh ?? 00h LAB_00132548: ADD RSP,0x8 XOR EAX,EAX POP RBX POP RBP RET ?? 66h f Actual src: const stp_parameter_t * stp_parameter_list_param(stp_const_parameter_list_t list, size_t item) { const stp_list_t *ilist = (const stp_list_t *)list; stp_list_item_t *i = NULL; if (item >= stp_list_get_length(ilist)) return NULL; else { i = stp_list_get_item_by_index(ilist, item); if (i == NULL) return NULL; return (const stp_parameter_t *) stp_list_item_get_data(i); } } Predicted src: static void item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_item_itemitemitemitemitemitem_item_item_itemitem_item_itemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemitemite ============================== Sample 5 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined pomodoro_stats_week_page_real_get_reference_value_data_free() PUSH RBP MOV RBP,RDI MOV RDI,qword ptr [RDI + 0x20] TEST RDI,RDI JZ LAB_00133eba CALL .plt.got:::g_object_unref ;undefined g_object_unref() MOV qword ptr [RBP + 0x20],0x0 LAB_00133eba: MOV RSI,RBP MOV EDI,0x30 POP RBP JMP .plt:::g_slice_free1 ;undefined g_slice_free1() ?? 0Fh Actual src: static void pomodoro_stats_week_page_real_get_reference_value_data_free (gpointer _data) { PomodoroStatsWeekPageGetReferenceValueData* _data_; _data_ = _data; _g_object_unref0 (_data_->self); g_slice_free (PomodoroStatsWeekPageGetReferenceValueData, _data_); } Predicted src: static void gimp_data_data_free (GObject *object) { g_object_unref (object); g_object_unref (G_OBJECT (object), NULL); g_object_unref (G_OBJECT (object), NULL); }