import capstone, struct, sys
sys.stdout.reconfigure(encoding="utf-8", errors="replace")
data = open(r"C:/git/bt411/content/BTL4OPT.EXE","rb").read()
pe = struct.unpack_from("<I", data, 0x3c)[0]
nsec = struct.unpack_from("<H", data, pe+6)[0]
opt = pe+24; szopt = struct.unpack_from("<H", data, pe+20)[0]
sec0 = opt+szopt
imgbase = struct.unpack_from("<I", data, opt+28)[0]
secs=[]
for i in range(nsec):
    off=sec0+i*40
    name=data[off:off+8].rstrip(b"\0").decode()
    vsz,va,rsz,ra=struct.unpack_from("<IIII",data,off+8)
    secs.append((name,va,rsz,ra))
text=[s for s in secs if s[0]=="CODE"][0]
va0=imgbase+text[1]; ra0=text[3]
START=0x4a2400; END=0x4a2d48
code=data[ra0+(START-va0):ra0+(END-va0)]
md=capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_32); md.detail=False
for ins in md.disasm(code, START):
    s=f"{ins.mnemonic} {ins.op_str}"
    if "esi" in s or "ebx" in s or "0x4a2d" in s:
        print(f"{ins.address:08x}: {s}")