import ctypes
import capstone

PROCESS_ALL_ACCESS = 0x1F0FFF
kernel32 = ctypes.windll.kernel32
h_proc = kernel32.OpenProcess(PROCESS_ALL_ACCESS, False, 43084)

def rpm(addr, size):
    buf = ctypes.create_string_buffer(size)
    bytes_read = ctypes.c_size_t(0)
    if kernel32.ReadProcessMemory(h_proc, ctypes.c_void_p(addr), buf, size, ctypes.byref(bytes_read)):
        return buf.raw
    return None

mod_base = 0x7FF6AFC20000
start_addr = 0x7ff6b0e2df00
size = 0x650
raw = rpm(start_addr, size)

md = capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_64)

for insn in md.disasm(raw, start_addr):
    rva = insn.address - mod_base
    extra = ""
    # Check if insn references RIP disp
    print(f"0x{insn.address:016x} (+{rva:07x}): {insn.mnemonic:8s} {insn.op_str}")

kernel32.CloseHandle(h_proc)