import r2pipe, sys, io
sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding='utf-8', errors='replace')

r2 = r2pipe.open("Z:/Development/devl/Havoc/HAVOC_NOCD.EXE",
                 ["-e", "bin.relocs.apply=true"])

print("=== 0x40AC00 (object creator - does it short-circuit?) ===")
print(r2.cmd("pd 30 @ 0x40ac00"))

print("\n=== 0x40ADF0 (second pool alloc, called after 0x429CA0) ===")
print(r2.cmd("pd 40 @ 0x40adf0"))

# Also: read the full 0x429CA0 past the loop to see if there's another crash_stub call
print("\n=== 0x429CA0 continued (after offset 0x429d57) ===")
print(r2.cmd("pd 40 @ 0x429d57"))

# Run the game and capture the new crash address
print("\n=== current patch state at crash site FO 0x290A0 area ===")
# Check if there's anything patched around FO 0x290A0 = VA 0x429CA0
print(r2.cmd("pd 5 @ 0x429ca0"))

r2.quit()