import struct
from capstone import *
from capstone.x86 import X86_OP_MEM, X86_REG_RIP

exe = r"F:\steam\steamapps\common\The I of the Dragon\TheIOfTheDragon.exe"
data = open(exe, "rb").read()
e = struct.unpack_from("<I", data, 0x3C)[0]
coff = e + 4
nsec = struct.unpack_from("<H", data, coff + 2)[0]
optsize = struct.unpack_from("<H", data, coff + 16)[0]
opt = coff + 20
imagebase = struct.unpack_from("<I", data, opt + 28)[0]
so = opt + optsize
secs = []
for i in range(nsec):
    o = so + i * 40
    nm = data[o:o+8].rstrip(b"\x00").decode("latin1")
    vs, va, rs, rp = struct.unpack_from("<IIII", data, o + 8)
    secs.append((nm, va, vs, rp, rs))

text = next(s for s in secs if s[0] == ".text")
name, tva, tvs, trp, trs = text
code = data[trp:trp+trs]
md = Cs(CS_ARCH_X86, CS_MODE_32)
md.detail = True

targets = {0x1c: "glyph[?]", 0x101c: "metrics", 0x181c: "usedflag"}
hits = {k: [] for k in targets}
for ins in md.disasm(code, imagebase + tva):
    if ins.mnemonic == "ret" or ins.mnemonic.startswith("j"):
        continue
    for op in ins.operands:
        if op.type == X86_OP_MEM and op.mem.disp in targets:
            hits[op.mem.disp].append((ins.address, ins.mnemonic, ins.op_str))
for k, v in hits.items():
    print("=== disp 0x%x (%s): %d refs ===" % (k, targets[k], len(v)))
    for a, m, o in v[:40]:
        print("  %08x: %s %s" % (a, m, o))