That's more or less it. Some things you can do: - Dataflow analysis, to get an idea of the types/range of values you're working with - Pattern matching to try

That's more or less it. Some things you can do: - Dataflow analysis, to get an idea of the types/range of values you're working with - Pattern matching to try to identify higher level constructs from math to loops to jump tables. - Compiler-specific pattern matching to identify things like function entry points - Signature pattern matching common functions (like C standard library calls), along the lines of what's used in High Level Emulation.