import r2pipe, sys, io
sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding='utf-8', errors='replace')

r2 = r2pipe.open("Z:/Development/devl/Havoc/HAVOC_NOCD.EXE",
                 ["-e", "bin.relocs.apply=true"])

# 0x41868A is the only caller of 0x429CA0
# Let's see the context there and 0x418600 (init function)
print("=== 0x418600 context (init function, caller of pool init) ===")
print(r2.cmd("pd 80 @ 0x418600"))

print("\n=== 0x43A960 (gating function: arg2==0 -> run pool init) ===")
print(r2.cmd("pd 30 @ 0x43a960"))

# Also check what's at VA 0x429EC1 and VA 0x429F6C (other crash_stub callers in 0x429CA0 area)
print("\n=== 0x429EB3 (pool_alloc call near 0x429EC1) ===")
print(r2.cmd("pd 25 @ 0x429eb3"))

print("\n=== 0x429F5E (pool_alloc call near 0x429F6C) ===")
print(r2.cmd("pd 25 @ 0x429f5e"))

r2.quit()