"""ADVERSARIAL VERIFY BATCH 5 -- attacking dim5 claim 5.

dim5 claim 5: "model+0x20950 ... is read only through model vtable slot 0x4d8
(accessor 0x18011c200). Its THREE consumers render a notification badge
(FUN_1800b1d00), a tab counter (FUN_1800aeb90), and a flow-state selector
(FUN_1800af3a0). No HTTP request is originated on any of those paths."

My independent objdump census of `call QWORD PTR [reg+0x4d8]` over the whole PE
found NINE sites, and of `call [reg+0x4e0]` (the SETTER) found SIX:
  0x4d8: 1800160c0 180019816 18007136b 18007e498 1800ad460 1800aeccf 1800aece6
         1800af449 1800b1d48
  0x4e0: 1800173d1 180019861 18007137b 1800ad498 1800bcb71 18013f222
Three of the 0x4d8 sites are immediately followed by a 0x4e0 site in the same
function -- a read-modify-WRITE of the counter that dim5 did not mention.
Resolve every containing function, and decompile the ones dim5 never examined.
CONTROL: 0x18013f222 must resolve to the userInfo deser 0x18013ec10 and 0x1800173d1
to FUN_180017390 -- the two sites dim5 DID identify. Same method for all nine.
"""
import traceback
try:
    S48 = [0x1800160c0, 0x180019816, 0x18007136b, 0x18007e498, 0x1800ad460,
           0x1800aeccf, 0x1800aece6, 0x1800af449, 0x1800b1d48]
    S4E = [0x1800173d1, 0x180019861, 0x18007137b, 0x1800ad498, 0x1800bcb71, 0x18013f222]
    print("=== containing functions ===")
    news = []
    for tag, lst in (("GET +0x4d8", S48), ("SET +0x4e0", S4E)):
        for a in lst:
            f = func(a)
            e = int(f.getEntryPoint().getOffset()) if f else 0
            print("  %s  %#x -> %s @ %#x" % (tag, a, f.getName() if f else "NONE", e))
            if e and e not in news:
                news.append(e)
    KNOWN = {0x1800b1d00, 0x1800aeb90, 0x1800af3a0, 0x180017390, 0x18013ec10}
    todo = [e for e in news if e not in KNOWN]
    print("\nfunctions dim5 never examined: %s" % ", ".join("%#x" % e for e in todo))
    for e in todo:
        s = dec(e)
        print("=" * 100)
        print("### DECOMPILE %#x len=%d" % (e, len(s)))
        print("=" * 100)
        print(s)
        print("### END %#x len=%d PRINTED IN FULL" % (e, len(s)))
except Exception:
    traceback.print_exc()