"""Raw-disassemble the AmmoBin cook-off cluster from BTL4OPT.EXE (#46).

Ghidra's export dropped the float math around the FUN_004dcd94 (__ftol) calls --
the decomp shows `iVar2 = FUN_004dcd94();` with the random-delay expression
missing entirely.  Recover:
  @004bd394  AmmoBinSimulation  (the arming expression: delay = f(?) )
  @004bd5c4  AmmoBin ctor       (who writes the Damage descriptor @+0x1F0/+0x1F4)
  @004bdb94  HandleMessage(1)   (same delay expression, crit-induced fire)
"""
import struct
from capstone import *

PATH = r"C:\git\bt411\content\BTL4OPT.EXE"
data = open(PATH, "rb").read()
e_lfanew = struct.unpack_from("<I", data, 0x3C)[0]
coff = e_lfanew + 4
num_sec = struct.unpack_from("<H", data, coff + 2)[0]
opt_size = struct.unpack_from("<H", data, coff + 16)[0]
opt = coff + 20
image_base = struct.unpack_from("<I", data, opt + 28)[0]
sec_tbl = opt + opt_size
secs = []
for i in range(num_sec):
    off = sec_tbl + i * 40
    vsize, va, rawsize, rawptr = struct.unpack_from("<IIII", data, off + 8)
    secs.append((va, vsize, rawptr, rawsize))


def va_to_off(va):
    rva = va - image_base
    for sva, vsize, rawptr, rawsize in secs:
        if sva <= rva < sva + max(vsize, rawsize):
            return rawptr + (rva - sva)
    return None


def dump_dword(va):
    off = va_to_off(va)
    return struct.unpack_from("<I", data, off)[0] if off is not None else None


def dump_float(va):
    off = va_to_off(va)
    return struct.unpack_from("<f", data, off)[0] if off is not None else None


md = Cs(CS_ARCH_X86, CS_MODE_32)

for name, va, length in (
    ("AmmoBinSimulation @004bd394", 0x004bd394, 0x160),
    ("AmmoBin ctor      @004bd5c4", 0x004bd5c4, 0xec),
    ("HandleMessage     @004bdb94", 0x004bdb94, 0x70),
):
    off = va_to_off(va)
    print("=" * 78)
    print(name)
    print("=" * 78)
    for ins in md.disasm(data[off:off + length], va):
        print("  %08x  %-24s %s %s" % (ins.address, ins.bytes.hex(), ins.mnemonic, ins.op_str))
    print()

# constants likely referenced by the delay math
for cva in (0x004bd4e8, 0x004bd4ec, 0x004bd4f0, 0x004bdb74, 0x004bdb78, 0x004bdb7c,
            0x004e0f74, 0x004e0f78, 0x004e0f7c, 0x004e0f80, 0x004e0f84, 0x004e0f88):
    print("DATA %08x: dword=%08x float=%r" % (cva, dump_dword(cva) or 0, dump_float(cva)))