import ctypes
from ctypes import wintypes
import capstone

PROCESS_VM_READ = 0x0010
PROCESS_QUERY_INFORMATION = 0x0400

kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
OpenProcess = kernel32.OpenProcess
OpenProcess.restype = wintypes.HANDLE
OpenProcess.argtypes = [wintypes.DWORD, wintypes.BOOL, wintypes.DWORD]

ReadProcessMemory = kernel32.ReadProcessMemory
ReadProcessMemory.restype = wintypes.BOOL
ReadProcessMemory.argtypes = [wintypes.HANDLE, wintypes.LPCVOID, wintypes.LPVOID, ctypes.c_size_t, ctypes.POINTER(ctypes.c_size_t)]

CloseHandle = kernel32.CloseHandle
CloseHandle.restype = wintypes.BOOL
CloseHandle.argtypes = [wintypes.HANDLE]

pid = 39484
h_proc = OpenProcess(PROCESS_VM_READ | PROCESS_QUERY_INFORMATION, False, pid)

md = capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_64)

for addr in [0x00007FF6B0E8FCEE, 0x00007FF6B0E9FE79, 0x00007FF6B0EA2891]:
    start = addr - 48
    size = 128
    buf = ctypes.create_string_buffer(size)
    bytes_read = ctypes.c_size_t(0)
    if ReadProcessMemory(h_proc, ctypes.c_void_p(start), buf, size, ctypes.byref(bytes_read)):
        raw = bytes(buf)
        print(f"\n==================== FogOfWar Ref @ 0x{addr:016X} ====================")
        for insn in md.disasm(raw, start):
            marker = "  >>> " if insn.address == addr else "      "
            print(f"{marker}0x{insn.address:016X}: {insn.mnemonic:<10} {insn.op_str}")

CloseHandle(h_proc)