import struct, sys, io
sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding='utf-8', errors='replace')

data = open('HAVOC_NOCD.EXE','rb').read()
FO2VA = lambda fo: fo + 0x400C00
VA2FO = lambda va: va - 0x400C00

target_va = 0x40AB90  # crash_stub

print("=== All CALL instructions targeting 0x40AB90 (crash_stub) ===")
for fo in range(0x400, len(data)-4):
    if data[fo] == 0xe8:
        rel = struct.unpack_from('<i', data, fo+1)[0]
        tgt = (FO2VA(fo+5) + rel) & 0xFFFFFFFF
        if tgt == target_va:
            caller_va = FO2VA(fo)
            print("  Caller at FO 0x%05x  VA 0x%08x" % (fo, caller_va))

print()
print("=== All CALL instructions targeting 0x40AAF0 (pool_alloc) ===")
target2 = 0x40AAF0
for fo in range(0x400, len(data)-4):
    if data[fo] == 0xe8:
        rel = struct.unpack_from('<i', data, fo+1)[0]
        tgt = (FO2VA(fo+5) + rel) & 0xFFFFFFFF
        if tgt == target2:
            print("  Caller at FO 0x%05x  VA 0x%08x" % (fo, FO2VA(fo)))

print()
print("=== Checking callers of 0x429CA0 ===")
target3 = 0x429CA0
for fo in range(0x400, len(data)-4):
    if data[fo] == 0xe8:
        rel = struct.unpack_from('<i', data, fo+1)[0]
        tgt = (FO2VA(fo+5) + rel) & 0xFFFFFFFF
        if tgt == target3:
            print("  Caller at FO 0x%05x  VA 0x%08x" % (fo, FO2VA(fo)))