from capstone.x86_const import X86_OP_MEM
c.detail=True
fs={}
for r in p.find(struct.pack('<i',0x290),executable=True):
 fi=p.containing_function(r)
 if fi is None: continue
 f=p.functions[fi]
 fs[f['beginRva']]=f
out=[]
for f in fs.values():
 ins=list(c.disasm(p.read(f['beginRva'],f['endRva']-f['beginRva']),f['beginRva']))
 matches=[x for x in ins if any(op.type==X86_OP_MEM and op.mem.disp==0x290 for op in x.operands)]
 if matches:
  out.append(dict(function=f,instructions=[dict(rva=x.address,mnemonic=x.mnemonic,operands=x.op_str) for x in ins],matches=[dict(rva=x.address,mnemonic=x.mnemonic,operands=x.op_str) for x in matches]))
Path('src/loader/runtime/profile-tools/devdata/creative-mode-146/current-tracking-context-references-20261016.json').write_text(json.dumps(out,indent=2))
print('count',len(out))
for f in out:
 if 0x900000<=f['function']['beginRva']<0xa00000: print(hex(f['function']['beginRva']),f['matches'])
