from capstone.x86_const import X86_OP_MEM
c.detail=True
fs={}
for disp in (0xebc030,0xebc2c0,0xebc2d0,0xebc2b0,0xebc2b4):
 for r in p.find(struct.pack('<I',disp),executable=True):
  fi=p.containing_function(r)
  if fi is not None: fs[p.functions[fi]['beginRva']]=p.functions[fi]
out=[]
for f in fs.values():
 ins=list(c.disasm(p.read(f['beginRva'],f['endRva']-f['beginRva']),f['beginRva']))
 matches=[x for x in ins if any(op.type==X86_OP_MEM and 0xebc030<=op.mem.disp<=0xebc2d0 for op in x.operands)]
 if matches:
  out.append(dict(function=f,instructions=[dict(rva=x.address,mnemonic=x.mnemonic,operands=x.op_str) for x in ins],matches=[dict(rva=x.address,mnemonic=x.mnemonic,operands=x.op_str) for x in matches]))
Path('src/loader/runtime/profile-tools/devdata/creative-mode-146/current-tracking-owner-references-20261016.json').write_text(json.dumps(out,indent=2))
for f in out: print(hex(f['function']['beginRva']),f['matches'])
