import capstone, struct, sys
sys.stdout.reconfigure(encoding="utf-8", errors="replace")
data=open(r"C:/git/bt411/content/BTL4OPT.EXE","rb").read()
CODE_VA=0x401000; CODE_RA=0xE00
md=capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_32)
code=data[CODE_RA+(0x4baa88-CODE_VA):CODE_RA+(0x4bace8-CODE_VA)]
prev_ret=None
for ins in md.disasm(code,0x4baa88):
    if ins.mnemonic=="ret":
        print(f"ret at {ins.address:08x}")
    if ins.mnemonic=="push" and ins.op_str=="ebp":
        print(f"push ebp at {ins.address:08x}")