# AUDIT-061 — conditional branches in sub_821C4EB0 [+0x44, +0xE0] = [0x821C4EF4, 0x821C4F90] # Format: PC mnemonic target annotation # # Range covers PCs from 0x821C4EF4 (cmplwi setting cr6 for branch B1) through # 0x821C4F90 (final bgt cr6 of the cmplwi r11,3 jump-table guard). # # B0 entry probe (function entry) — for sanity-check call counting. 0x821C4EB0 entry - function entry — count calls to sub_821C4EB0 # # Conditional branches: 0x821C4EF8 beq cr6 0x821C4F20 after cmplwi cr6, r3, 0 (r3 = sub_82150EF8 return). 0x821C4F3C bne cr6 0x821C4F7C after lbz r10, 12932(0x828F<<16)+cmplwi r10,0 — byte test of static flag. 0x821C4F70 beq cr6 0x821C4F78 after lwz r3, 92(r30) — skip bl 0x824AA3E0 when *(r30+92)==0. 0x821C4F90 bgt cr6 0x821C5000 after cmplwi cr6, r11, 3 — guards 4-entry jump table at 0x821C4F94..0x821C4FAC. # # Post-bl PCs we want to count too (taken-paths to sub_821CEDF8 etc.): 0x821C4F14 bl 0x821CC3F8 call to sub_821CC3F8 (the canary-only 5x callee per AUDIT-056? — actually sub_821CEDF8 is the one, this is sub_821CC3F8). Will instrument to count. 0x821C4F2C bl 0x82187C30 call to sub_82187C30 — AUDIT-056 caller-LR. 0x821C4F60 bl 0x82172370 call to sub_82172370 — significant downstream caller. 0x821C4F74 bl 0x824AA3E0 call to sub_824AA3E0 — KE/ wait-related? Conditional on prior beq.