import sys, struct
from capstone import *
import pefile

EXE = sys.argv[3] if len(sys.argv)>3 else '/Users/jing/Documents/yutong/yutongapp/TP5(En).exe'
d = open(EXE,'rb').read()
BASE = 0x400000
pe = pefile.PE(EXE)

# import name map
imp = {}
for e in pe.DIRECTORY_ENTRY_IMPORT:
    for i in e.imports:
        imp[i.address] = (e.dll.decode(), i.name.decode() if i.name else 'ord%d'%i.ordinal)

md = Cs(CS_ARCH_X86, CS_MODE_32)
md.detail = True

start = int(sys.argv[1],16)
n = int(sys.argv[2],16) if len(sys.argv)>2 else 0x200

off = start - BASE
for ins in md.disasm(d[off:off+n], start):
    s = "%08x  %-24s %s %s" % (ins.address, ins.bytes.hex(), ins.mnemonic, ins.op_str)
    # annotate indirect calls
    if ins.mnemonic in ('call','jmp') and 'dword ptr [0x' in ins.op_str:
        try:
            a = int(ins.op_str.split('[')[1].split(']')[0],16)
            if a in imp: s += '   ; %s!%s' % imp[a]
        except: pass
    print(s)