import capstone, struct, sys
sys.stdout.reconfigure(encoding="utf-8", errors="replace")
data = open(r"C:/git/bt411/content/BTL4OPT.EXE","rb").read()
CODE_VA=0x401000; CODE_RA=0xE00
# scan whole CODE section but report region; disp32 0x434 pattern
pat = b"\x34\x04\x00\x00"
md = capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_32); md.detail=False
# find CODE section size
pe = struct.unpack_from("<I", data, 0x3c)[0]
nsec = struct.unpack_from("<H", data, pe+6)[0]
opt=pe+24; szopt=struct.unpack_from("<H",data,pe+20)[0]; sec0=opt+szopt
for i in range(nsec):
    off=sec0+i*40
    name=data[off:off+8].rstrip(b"\0").decode()
    vsz,va,rsz,ra=struct.unpack_from("<IIII",data,off+8)
    if name=="CODE": code_rsz=rsz
start=0
hits=[]
while True:
    idx = data.find(pat, start)
    if idx<0: break
    start=idx+1
    if not (CODE_RA <= idx < CODE_RA+code_rsz): continue
    va = CODE_VA + (idx - CODE_RA)
    # try disassembling from a few candidate starts before the disp
    for back in range(2,9):
        chunk = data[idx-back: idx-back+16]
        insns = list(md.disasm(chunk, va-back))
        if insns:
            i0 = insns[0]
            if "0x434" in i0.op_str and i0.address+i0.size >= va+4 and i0.address+i0.size <= va+4+4:
                hits.append((i0.address, f"{i0.mnemonic} {i0.op_str}", i0.size))
                break
seen=set()
for a,s,sz in sorted(hits):
    if a in seen: continue
    seen.add(a)
    region = "MECH" if 0x49e000<=a<0x4c0000 else ""
    print(f"{a:08x} {region:5s} {s}")