import r2pipe, sys, io
sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding='utf-8', errors='replace')

r2 = r2pipe.open("Z:/Development/devl/Havoc/HAVOC_NOCD.EXE",
                 ["-e", "bin.relocs.apply=true"])
# No aaa - just raw disassembly

print("=== crash_stub at 0x40AB90 (crash site) ===")
print(r2.cmd("pd 4 @ 0x40ab90"))

print("\n=== pool allocator 0x40AAF0 (what calls crash_stub?) ===")
print(r2.cmd("pd 50 @ 0x40aaf0"))

print("\n=== function 0x429CA0 = caller FO 0x290A0 ===")
print(r2.cmd("pd 60 @ 0x429ca0"))

print("\n=== 0x40ABD0: zeroed alloc (does it check for NULL?) ===")
print(r2.cmd("pd 20 @ 0x40abd0"))

print("\n=== 0x465050: VirtualAlloc path ===")
print(r2.cmd("pd 30 @ 0x465050"))

r2.quit()