import r2pipe, sys, io
sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding='utf-8', errors='replace')

r2 = r2pipe.open("HAVOC_NOCD.EXE", ["-e", "anal.strings=false"])
r2.cmd("aaa")  # analyze all

def disasm(addr, n=20):
    return r2.cmd("pd %d @ 0x%x" % (n, addr))

def xrefs_to(addr):
    return r2.cmd("axt @ 0x%x" % addr)

def xrefs_from(addr):
    return r2.cmd("axf @ 0x%x" % addr)

print("=== Entry point function ===")
ep_info = r2.cmd("ie")
print(ep_info)

print("=== 0x464DCA (first call from entry, CRT init?) ===")
print(disasm(0x464DCA, 40))

print("=== Search for writes to [0x480964] (heap handle init) ===")
# Search for MOV [0x480964], something
hits = r2.cmd("/ \\xa3\\x64\\x09\\x48\\x00")  # MOV [0x480964],EAX
print("MOV [0x480964],EAX hits:", hits)
hits2 = r2.cmd("/ \\x89\\x05\\x64\\x09\\x48\\x00")  # MOV [0x480964],r32
print("MOV [0x480964],r32 hits:", hits2)

print("=== 0x465BD3 (global ctor runner?) ===")
print(disasm(0x465BD3, 40))

print("=== 0x465BC8 ===")
print(disasm(0x465BC8, 20))

r2.quit()