============================== Sample 1 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined parser_isexpr() ;local_10 undefined8 -10 ;local_14 undefined4 -14 ;local_20 undefined8 -20 ;local_28 undefined8 -28 ;local_30 undefined8 -30 PUSH RBP MOV RBP,RSP SUB RSP,0x30 MOV qword ptr [RBP + local_20+0x8],RDI MOV qword ptr [RBP + local_28+0x8],RSI MOV qword ptr [RBP + local_30+0x8],RDX MOV qword ptr [RBP + local_10+0x8],0x0 MOV RAX,qword ptr [RBP + local_20+0x8] TEST RAX,RAX JNZ LAB_00102ebc LEA RDX=>local_20,[RBP + -0x18] MOV RSI,qword ptr [RBP + local_30+0x8] MOV RAX,qword ptr [RBP + local_28+0x8] MOV R9,RDX LEA R8,[.data:PyST_Type] LEA RDX,[.data:keywords.4] MOV RCX=>.data:keywords.4,RDX LEA RDX,[.rodata:s_O!:isexpr_0010d2cc] ;= "O!:isexpr" MOV RDI,RAX MOV EAX,0x0 CALL .plt:PyArg_ParseTupleAndKeywords ;undefined PyArg_ParseTupleAndKeywords() MOV dword ptr [RBP + local_14+0x8],EAX JMP LAB_00102ee5 LAB_00102ebc: MOV RSI,qword ptr [RBP + local_30+0x8] MOV RAX,qword ptr [RBP + local_28+0x8] LEA RDX,[.data:keywords.4[8]] MOV RCX=>.data:keywords.4[8],RDX LEA RDX,[.rodata:s_:isexpr_0010d2d6] ;= ":isexpr" MOV RDI,RAX MOV EAX,0x0 CALL .plt:PyArg_ParseTupleAndKeywords ;undefined PyArg_ParseTupleAndKeywords() MOV dword ptr [RBP + local_14+0x8],EAX LAB_00102ee5: CMP dword ptr [RBP + local_14+0x8],0x0 JZ LAB_00102f37 MOV RAX,qword ptr [RBP + local_20+0x8] MOV EAX,dword ptr [RAX + 0x28] CMP EAX,0x1 JNZ LAB_00102f00 MOV RAX,qword ptr [->_Py_TrueStruct] ;= 00112170 JMP LAB_00102f07 LAB_00102f00: MOV RAX,qword ptr [->_Py_ZeroStruct] ;= 00112020 LAB_00102f07: ; FWD[3,0]: Stack[-0x10],00112020,00112170 MOV qword ptr [RBP + local_10+0x8],RAX=>EXTERNAL:_Py_TrueStruct ;=?? MOV RAX,qword ptr [->_Py_RefTotal] ;= 00112178 MOV RAX=>EXTERNAL:_Py_RefTotal,qword ptr [RAX] ;=?? LEA RDX,[RAX + 0x1] MOV RAX,qword ptr [->_Py_RefTotal] ;= 00112178 MOV qword ptr [RAX]=>EXTERNAL:_Py_RefTotal,RDX ;=?? MOV RAX,qword ptr [RBP + local_10+0x8] ; FWD[2,0]: 00112030,00112180 MOV RAX,qword ptr [RAX + 0x10]=>EXTERNAL:PyDict_New ;=?? LEA RDX,[RAX + 0x1] MOV RAX,qword ptr [RBP + local_10+0x8] ; FWD[2,0]: 00112030,00112180 MOV qword ptr [RAX + 0x10]=>EXTERNAL:PyDict_New,RDX ;=?? LAB_00102f37: ; FWD[3,0]: Stack[-0x10],00112020,00112170 MOV RAX=>EXTERNAL:_Py_TrueStruct,qword ptr [RBP + local_10+0x8] ;=?? LEAVE RET ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined parser_issuite() ;local_10 undefined8 -10 ;local_14 undefined4 -14 ;local_20 undefined8 -20 ;local_28 undefined8 -28 ;local_30 undefined8 -30 PUSH RBP Actual src: static PyObject* parser_isexpr(PyST_Object *self, PyObject *args, PyObject *kw) { PyObject* res = 0; int ok; static char *keywords[] = {"ast", NULL}; if (self == NULL) ok = PyArg_ParseTupleAndKeywords(args, kw, "O!:isexpr", keywords, &PyST_Type, &self); else ok = PyArg_ParseTupleAndKeywords(args, kw, ":isexpr", &keywords[1]); if (ok) { /* Check to see if the ST represents an expression or not. */ res = (self->st_type == PyST_EXPR)? Py_True : Py_False; Py_INCREF(res); } return (res); } Predicted src: static PyObject * is_dealloc(PyObject *self, PyObject *args) { PyObject *self = NULL; if (!PyArg_ParseTuple(args, "O:is_dealloc", &Py_Type, &Py_Type, &Py_Type)) return NULL; Py_INCREF(Py_None); Py_INCREF(Py_None); return self; } ============================== Sample 2 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined QCoreApplication_quit(void) JMP .plt:::QCoreApplication::quit ?? 66h f Actual src: void QCoreApplication_quit() { QCoreApplication::quit(); } Predicted src: void QLayout_quit(QLayoutH handle) { ((QLayout *)handle)->quit(); } ============================== Sample 3 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined gimp_curves_tool_key_press() PUSH R13 MOV R13,RDX PUSH R12 MOV R12,RSI PUSH RBP MOV RBP,RDI CALL gimp_curves_tool_get_type ;undefined gimp_curves_tool_get_type() MOV RDI,RBP MOV RSI,RAX CALL .plt:::g_type_check_instance_cast ;undefined g_type_check_instance_cast() CMP qword ptr [RBP + 0x58],0x0 JZ LAB_0024f7fd MOV RDI,qword ptr [RAX + 0x2c8] TEST RDI,RDI JZ LAB_0024f7fd MOV RSI,R12 CALL .plt:::gtk_widget_event ;undefined gtk_widget_event() TEST EAX,EAX JNZ LAB_0024f830 LAB_0024f7fd: CALL gimp_tool_get_type ;undefined gimp_tool_get_type() MOV RDI,qword ptr [.bss:gimp_curves_tool_parent_class] MOV RSI,RAX CALL .plt:::g_type_check_class_cast ;undefined g_type_check_class_cast() MOV RDX,R13 MOV RSI,R12 MOV RDI,RBP MOV RAX,qword ptr [RAX + 0xd8] POP RBP POP R12 POP R13 JMP RAX ?? 0Fh ;? -> 00841f0f ?? 1Fh ?? 84h ?? 00h ?? 00h ?? 00h ?? 00h ?? 00h LAB_0024f830: POP RBP MOV EAX,0x1 POP R12 POP R13 RET ?? 0Fh Actual src: static gboolean gimp_curves_tool_key_press (GimpTool *tool, GdkEventKey *kevent, GimpDisplay *display) { GimpCurvesTool *c_tool = GIMP_CURVES_TOOL (tool); if (tool->display && c_tool->graph) { if (gtk_widget_event (c_tool->graph, (GdkEvent *) kevent)) return TRUE; } return GIMP_TOOL_CLASS (parent_class)->key_press (tool, kevent, display); } Predicted src: static gboolean gimp_tool_tool_event (GtkWidget *widget, GdkEvent *event) { GimpTool *tool_tool = GIMP_TOOL (widget); if (tool_tool->tool_event) { if (tool_tool->tool_event) { gimp_tool_tool_event (tool_tool->tool_event); return TRUE; } } return FALSE; } ============================== Sample 4 ============================== ASM: ;************************************************************************************************************************************************************ ;* ONScripter::brCommand() * ;************************************************************************************************************************************************************ ;undefined brCommand(ONScripter * this) ;this ONScripter * RDI PUSH R12 MOV ESI,0x1 PUSH RBP PUSH RBX MOV RBX,this CALL ONScripter::enterTextDisplayMode ;undefined enterTextDisplayMode(ONScr... LEA this,[RBX + 0xcb8] CALL FontInfo::newLine ;undefined newLine(FontInfo * this) MOV RBX,qword ptr [RBX + 0xbf8] MOVSXD RDX,dword ptr [RBX + 0x1c] MOV this,dword ptr [RBX + 0x18] CMP EDX,this JGE LAB_00124540 MOV RBP,qword ptr [RBX + 0x10] LAB_00124523: LEA EAX,[RDX + 0x1] MOV dword ptr [RBX + 0x1c],EAX MOV EAX,0x2 MOV byte ptr [RBP + RDX*0x1],0xa POP RBX POP RBP POP R12 RET ?? 0Fh ?? 1Fh ?? 84h ?? 00h ?? 00h ?? 00h ?? 00h ?? 00h LAB_00124540: ADD this,this MOVSXD this,this CALL .plt:::operator.new[] ;void * operator.new[](ulong param_1) MOV R12,qword ptr [RBX + 0x10] MOVSXD RDX,dword ptr [RBX + 0x18] MOV this,RAX MOV RBP,RAX MOV RSI,R12 CALL .plt:::memcpy ;void * memcpy(void * __dest, void *... MOV this,R12 CALL .plt:::operator.delete[] ;void operator.delete[](void * param_1) MOV qword ptr [RBX + 0x10],RBP MOVSXD RDX,dword ptr [RBX + 0x1c] SHL dword ptr [RBX + 0x18],1 JMP LAB_00124523 ?? 90h Actual src: int ONScripter::brCommand() { enterTextDisplayMode(); sentence_font.newLine(); current_page->add( 0x0a ); return RET_CONTINUE; } Predicted src: void TTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTextTex ============================== Sample 5 ============================== ASM: ;************************************************************************************************************************************************************ ;* FUNCTION * ;************************************************************************************************************************************************************ ;undefined secu_PrintDecodedBitString() ;local_28 undefined8 -28 ;local_38 undefined1[16] -38 PUSH R12 MOV R12D,ECX PUSH RBP MOV RBP,RDI PUSH RBX SUB RSP,0x20 MOV RCX,qword ptr [RSI + 0x10] MOVDQU XMM0,xmmword ptr [RSI] MOV RSI,RSP MOV EAX,ECX MOV EBX,ECX MOV qword ptr [RSP + local_28+0x38],RCX MOV ECX,R12D ADD EAX,0x7 MOVAPS xmmword ptr [RSP]=>local_38,XMM0 SHR EAX,0x3 MOV dword ptr [RSP + local_28+0x38],EAX AND EBX,0x7 JZ LAB_0010a200 CALL SECU_PrintAsHex ;undefined SECU_PrintAsHex() LEA ESI,[R12 + 0x1] MOV RDI,RBP CALL SECU_Indent ;undefined SECU_Indent() MOV ECX,0x8 MOV RDI,RBP XOR EAX,EAX SUB ECX,EBX LEA RDX,[.rodata:s_(%d_least_significant_bits_unuse_00116290] ;= "(%d least significant bits unused... MOV ESI,0x1 CALL .plt:::__fprintf_chk ;undefined __fprintf_chk() ADD RSP,0x20 POP RBX POP RBP POP R12 RET LAB_0010a200: CALL SECU_PrintAsHex ;undefined SECU_PrintAsHex() ADD RSP,0x20 POP RBX POP RBP POP R12 RET ?? 66h f Actual src: static void secu_PrintDecodedBitString(FILE *out, const SECItem *i, const char *m, int level) { int unused_bits; SECItem tmp = *i; unused_bits = (tmp.len & 0x7)? 8 - (tmp.len & 7) : 0; DER_ConvertBitString(&tmp); /* convert length to byte length */ SECU_PrintAsHex(out, &tmp, m, level); if (unused_bits) { SECU_Indent(out, level + 1); fprintf(out, "(%d least significant bits unused)\n", unused_bits); } } Predicted src: static int u_WriteString(const char *s, const char *s, size_t len) { u_char buf[256]; u_char buf[256]; u_char buf[256]; u_char buf[256]; u_char buf[256]; buf[0] = '\0'; buf[1] = '\0'; buf[2] = '\0'; buf[3] = '\0'; buf[3] = '\0'; buf[3] = '\0'; buf[3] = '\0'; buf[3] = '\0'; buf[3] = '\0'; buf[3] = '\0'; buf[3] = '\0'; buf[3] = '\0'; buf[3] = '\0'; return(0); }