  Analyzing third-party software such as malware or firmware is a crucial task
for security analysts. Although various approaches for automatic analysis exist
and are the subject of ongoing research, analysts often have to resort to
manual static analysis to get a deep understanding of a given binary sample.
Since the source code of encountered samples is rarely available, analysts
regularly employ decompilers for easier and faster comprehension than analyzing
a binary's disassembly.
  In this paper, we introduce our decompilation approach dewolf. We developed a
variety of improvements over the previous academic state-of-the-art decompiler
and some novel algorithms to enhance readability and comprehension, focusing on
manual analysis. To evaluate our approach and to obtain a better insight into
the analysts' needs, we conducted three user surveys. The results indicate that
dewolf is suitable for malware comprehension and that its output quality
noticeably exceeds Ghidra and Hex-Rays in certain aspects. Furthermore, our
results imply that decompilers aiming at manual analysis should be highly
configurable to respect individual user preferences. Additionally, future
decompilers should not necessarily follow the unwritten rule to stick to the
code-structure dictated by the assembly in order to produce readable output. In
fact, the few cases where dewolf already cracks this rule lead to its results
considerably exceeding other decompilers. We publish a prototype implementation
of dewolf and all survey results on GitHub.
