============================== Sample 1 ============================== ASM: ;************************************************************************************************************************************************************ ;* soap_get_PointerTomatrix(soap*, matrix**, char const*, char const*) * ;************************************************************************************************************************************************************ ;undefined soap_get_PointerTomatrix(soap * param_1, matrix * * param_2, char * param_3, char * param_4) ;param_1 soap * RDI ;param_2 matrix * * RSI ;param_3 char * RDX ;param_4 char * RCX PUSH R12 MOV R8,param_2 MOV param_2,param_3 PUSH RBP MOV param_3,R8 MOV RBP,param_1 SUB RSP,0x8 CALL soap_in_PointerTomatrix ;undefined soap_in_PointerTomatrix(so... TEST RAX,RAX JZ LAB_0010a430 MOV param_1,RBP MOV R12,RAX CALL soap_getindependent ;undefined soap_getindependent(soap *... TEST EAX,EAX JNZ LAB_0010a430 ADD RSP,0x8 MOV RAX,R12 POP RBP POP R12 RET ?? 66h f ?? 0Fh ?? 1Fh ?? 84h ?? 00h ?? 00h ?? 00h ?? 00h ?? 00h LAB_0010a430: XOR R12D,R12D ADD RSP,0x8 MOV RAX,R12 POP RBP POP R12 RET ?? 66h f Actual src: matrix ** SOAP_FMAC4 soap_get_PointerTomatrix(struct soap *soap, matrix **p, const char *tag, const char *type) { if ((p = soap_in_PointerTomatrix(soap, tag, p, type))) if (soap_getindependent(soap)) return NULL; return p; } Predicted src: struct * SOAP_FMAC4 soap_get_FMAC4 soap_ns4 soap_get_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_get_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_get_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap soap_ns4 soap_ns4 soap_ns4 soap soap soap soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap_ns4 soap soap_ns4 soap soap_ns4 soap_ns4 soap_ns4 soap soap soap_ns4 soap soap soap_ns4 soap_ns4 soap soap soap_ns4 soap soap soap soap_ns4 soap soap_ns4 soap soap soap_ns4 soap soap soap soap soap_ns4 soap soap soap_ns4 soap soap soap soap_ns4 soap soap soap soap_ns4 soap soap soap soap_ns4 soap soap soap soap_ns4 soap soap soap soap soap soap soap soap soap soap soap_ns4 soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap_ns4 soap soap soap soap soap soap soap soap soap soap soap_ns4 soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soap soa ============================== Sample 2 ============================== ASM: ;************************************************************************************************************************************************************ ;* Mus_IsPlaying() * ;************************************************************************************************************************************************************ ;undefined Mus_IsPlaying(void) SUB RSP,0x8 CALL App_AudioSystem ;undefined App_AudioSystem(void) ADD RSP,0x8 MOV RDI,RAX JMP AudioSystem::musicIsPlaying ;undefined musicIsPlaying(AudioSystem... ?? 66h f Actual src: bool Mus_IsPlaying() { #ifdef __CLIENT__ return App_AudioSystem().musicIsPlaying(); #else return false; #endif } Predicted src: bool is_Is() { return is_Is_Is_Is_Is(); } ============================== Sample 3 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined cmdServerSigChild() MOV RDI,qword ptr [.bss:serverLocal[24]] MOV EAX,dword ptr [RDI] TEST EAX,EAX JZ LAB_0014d0c0 PUSH RBP MOV RBP,RSI PUSH RBX XOR EBX,EBX SUB RSP,0x8 JMP LAB_0014d08e ?? 66h f ?? 0Fh ?? 1Fh ?? 44h D ?? 00h ?? 00h LAB_0014d080: MOV RDI,qword ptr [.bss:serverLocal[24]] ADD EBX,0x1 CMP dword ptr [RDI],EBX JBE LAB_0014d0b8 LAB_0014d08e: MOV ESI,EBX CALL lstGet ;undefined lstGet() MOV EDX,dword ptr [RBP + 0x10] CMP dword ptr [RAX],EDX JNZ LAB_0014d080 MOV RDI,qword ptr [.bss:serverLocal[24]] MOV ESI,EBX ADD EBX,0x1 CALL lstRemoveIdx ;undefined lstRemoveIdx() MOV RDI,qword ptr [.bss:serverLocal[24]] CMP dword ptr [RDI],EBX JA LAB_0014d08e LAB_0014d0b8: ADD RSP,0x8 POP RBX POP RBP RET ?? 90h LAB_0014d0c0: RET ?? 66h f Actual src: static void cmdServerSigChild(const int signalType, siginfo_t *signalInfo, void *context) { (void)signalType; (void)context; ASSERT(signalInfo->si_code == CLD_EXITED); // Find the process and remove it for (unsigned int processIdx = 0; processIdx < lstSize(serverLocal.processList); processIdx++) { if (*(int *)lstGet(serverLocal.processList, processIdx) == signalInfo->si_pid) lstRemoveIdx(serverLocal.processList, processIdx); } } Predicted src: static void serverserver(Widget w, XtPointer client_data, XtPointer call_data) { int i; for (i = 0; i < 0; i++) { if (serverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserverserve ============================== Sample 4 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;void clipboard_destroy(object * obj) ;obj object * RDI PUSH R13 MOV R13,obj PUSH R12 LEA R12,[R13 + 0x70] PUSH RBP PUSH RBX SUB RSP,0x8 MOV obj,qword ptr [obj->refcount + 0x90] CALL .plt:::free ;void free(void * __ptr) MOV RBP,qword ptr [R13 + 0x70] MOV RBX,qword ptr [RBP] CMP RBP,R12 JZ LAB_0011736b NOP word ptr [RAX + RAX*0x1] LAB_00117340: MOV RAX,qword ptr [RBP + 0x8] MOV qword ptr [RBX + 0x8],RAX MOV RDX,qword ptr [RBP] MOV qword ptr [RAX],RDX MOV obj,qword ptr [RBP + 0x20] CALL .plt:::free ;void free(void * __ptr) MOV obj,RBP MOV RBP,RBX CALL .plt:::free ;void free(void * __ptr) MOV RBX,qword ptr [RBX] CMP RBP,R12 JNZ LAB_00117340 LAB_0011736b: MOV qword ptr [R13 + 0x80],0x0 ADD RSP,0x8 POP RBX POP RBP POP R12 POP R13 RET ?? 66h f Actual src: static void clipboard_destroy( struct object *obj ) { struct clipboard *clipboard = (struct clipboard *)obj; free( clipboard->listeners ); free_clipboard_formats( clipboard ); } Predicted src: static void destroy_object(void *obj) { struct obj *obj = obj; struct obj *obj = obj; struct obj *obj = obj; for (obj = obj; obj; obj = obj->next) { obj = obj->next; obj->next = obj->next; obj->next = obj->next; obj->next = obj->next; obj->next = obj->next; } free(obj); } ============================== Sample 5 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined g_flags_class_init() PUSH RBP PUSH RBX SUB RSP,0x8 TEST RDI,RDI JZ LAB_00115a25 CMP qword ptr [RDI],0x34 MOV RBP,RDI MOV RBX,RSI JZ LAB_00115a48 MOV ESI,0x34 CALL g_type_check_class_is_a ;undefined g_type_check_class_is_a() TEST EAX,EAX JNZ LAB_00115a48 LAB_00115a25: ADD RSP,0x8 LEA RDX,[.rodata:s_G_IS_FLAGS_CLASS_(class)_00140d3b] ;= "G_IS_FLAGS_CLASS (class)" LEA RSI,[.rodata:__func__.15] ;= "g_flags_class_init" POP RBX LEA RDI,[.rodata:s_GLib-GObject_0013f3e8] ;= "GLib-GObject" POP RBP JMP .plt:::g_return_if_fail_warning ;undefined g_return_if_fail_warning() ?? 0Fh ?? 1Fh ?? 00h LAB_00115a48: MOV qword ptr [RBP + 0x8],0x0 MOV qword ptr [RBP + 0x10],RBX TEST RBX,RBX JZ LAB_00115a86 XOR EAX,EAX CMP qword ptr [RBX + 0x8],0x0 MOV EDX,0x1 JZ LAB_00115a86 NOP word ptr [RAX + RAX*0x1] LAB_00115a70: OR EAX,dword ptr [RBX] ADD RBX,0x18 MOV dword ptr [RBP + 0xc],EDX ADD EDX,0x1 MOV dword ptr [RBP + 0x8],EAX CMP qword ptr [RBX + 0x8],0x0 JNZ LAB_00115a70 LAB_00115a86: ADD RSP,0x8 POP RBX POP RBP RET ?? 0Fh Actual src: static void g_flags_class_init (GFlagsClass *class, gpointer class_data) { g_return_if_fail (G_IS_FLAGS_CLASS (class)); class->mask = 0; class->n_values = 0; class->values = class_data; if (class->values) { GFlagsValue *values; for (values = class->values; values->value_name; values++) { class->mask |= values->value; class->n_values++; } } } Predicted src: static void g_class_init (GClass *klass) { g_return_if_fail (klass!= NULL); g_return_if_fail (G_IS_OBJECT (klass)); klass->type = G_OBJECT_CLASS; klass->type = G_OBJECT_CLASS; klass->type = G_OBJECT_CLASS; }