"""Raw-disassemble Searchlight::ToggleLamp @004b838c -- a Ghidra export gap (#60).

The exported functions_index.tsv jumps straight to 4b83b8, so this body was never
in the pseudocode.  It is the handler bound by Searchlight's message table
@0051117c {3, "ToggleLamp"@00511440, @004b838c}.  Same technique that recovered
EjectAmmo @004bb9b8 (see context/decomp-reference.md).

Also dumps ThermalSight's @004b860c for a side-by-side, since that one IS exported
and is the structural sibling the reconstruction was inferred from.
"""
import struct
from capstone import *

PATH = r"C:\git\bt411\content\BTL4OPT.EXE"
data = open(PATH, "rb").read()
e_lfanew = struct.unpack_from("<I", data, 0x3C)[0]
coff = e_lfanew + 4
num_sec = struct.unpack_from("<H", data, coff + 2)[0]
opt_size = struct.unpack_from("<H", data, coff + 16)[0]
opt = coff + 20
image_base = struct.unpack_from("<I", data, opt + 28)[0]
sec_tbl = opt + opt_size
secs = []
for i in range(num_sec):
    off = sec_tbl + i * 40
    vsize, va, rawsize, rawptr = struct.unpack_from("<IIII", data, off + 8)
    secs.append((va, vsize, rawptr, rawsize))


def va_to_off(va):
    rva = va - image_base
    for sva, vsize, rawptr, rawsize in secs:
        if sva <= rva < sva + max(vsize, rawsize):
            return rawptr + (rva - sva)
    return None


md = Cs(CS_ARCH_X86, CS_MODE_32)

for name, va, length in (
    ("Searchlight::ToggleLamp  @004b838c  (EXPORT GAP -- ground truth)", 0x004b838c, 0x2c),
    ("ThermalSight::ToggleLamp @004b860c  (exported sibling)", 0x004b860c, 0x3c),
):
    off = va_to_off(va)
    print("=" * 78)
    print(name)
    print("=" * 78)
    for ins in md.disasm(data[off:off + length], va):
        print("  %08x  %-22s %s %s" % (ins.address, ins.bytes.hex(), ins.mnemonic, ins.op_str))
    print()